Skip to end of banner
Go to start of banner

Pen Test 2023 Results

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this content. View the current version.

Compare with Current View Version History

« Previous Version 15 Current »

Whilst more were logged during the test, these were directly related to the test being performed on our development site. We have excluded these from this listing: -

  1. Security Misconfiguration – Stack Trace Observed - We can confirm that stack traces are disabled on all live/production environments. This is purely present as it is our dev environment.

  2. Security Misconfiguration - Laravel Debugging Enabled -this is purely related to the fact that it is a development environment and is already disabled on the Production environment.

  3. Security Misconfiguration - Stack Trace Available to Anonymous Users - To confirm this is only enabled on the development environment and is disabled on our production environments

Issue

A04:2021 – Insecure Design - Delete EPA/EPA Manager Request Susceptible to CSRF

Priority

LOW

EP Number

EP-3868 - Getting issue details... STATUS

Resolution

We have updated the EPA/EPAM user listing screens to use the new condensed menu that is being rolled out across epaPRO.

Issue

A06:2021 Vulnerable and Outdated Components

Priority

LOW

EP Number

SD-7697 - Getting issue details... STATUS

Resolution

Latest version of PHP was updated within the usual release cycle to the latest version, this was already scheduled to take place after the test was carried out.
Momentjs is no longer actively developed and so an alternative would need to be developed.

Issue

A07:2021 – Identification and Authentication Failures - Account Enumeration Possible Via Login Page

Priority

LOW

EP Number

EP-3867 - Getting issue details... STATUS

Resolution:

The test noted that there was a difference in styling on the error messages (bold vs. normal text). These instances now return the same, consistently styled error message to the user.

Issue

Security Misconfiguration - Missing Sub resource Integrity For External Scripts

Priority

RAISED FOR REFERENCE ONLY

EP Number

N/A

Resolution:

Declined - we cannot add an SRI check here to validate the content, as Google necessitate implicit trust of their content.

Issue

A02 - Cryptographic Failures – Weak Ciphers Within TLSv1.2 Supported

Priority

LOW

EP Number

EP-4203 - Getting issue details... STATUS

Resolution:

TBC

  • No labels

0 Comments

You are not logged in. Any changes you make will be marked as anonymous. You may want to Log In if you already have an account.