OWASP A01:2021 – Broken Access Control

OWASP A02:2021 – Cryptographic Failures

OWASP A03:2021 – Injection

OWASP A04:2021 – Insecure Design

OWASP A05:2021 – Security Misconfiguration

OWASP A06:2021 – Vulnerable and Outdated Components

OWASP A07:2021 – Identification and Authentication Failures

OWASP A08:2021 – Software and Data Integrity Failures

OWASP A09:2021 – Security Logging and Monitoring Failures

OWASP A10:2021 – Server-Side Request Forgery (SSRF)

Blind SQL injection (SQLi)

Critical

This vulnerability not only allows an attacker to retrieve all of the data from the database, but for issuing commands to the database to interact with remote attacker-controlled systems.

GraphQL Broken Authorization

Critical

This allows a low privileged attacker to perform any action an admin is allowed to, by crafting requests, easily enumerable and identifiable due to Introspection being enabled, including changing any user’s passwords, escalating privileges to an admin, etc.

Blind XML external entity injection (XXE)

High

External entities can reference files on the parser’s filesystem; exploiting this feature may allow retrieval of arbitrary files, or denial of service by causing the server to read from a file.

Local file inclusion (LFI)

High

This vulnerability can lead to information disclosure of files stored in Web Server, passwords/database access, log files and complete system compromise.

Referrer dependent pages enabled

Medium

This can allow attackers to bypass the GraphQL API along with any security restrictions implemented for the API.

⛔

Default Passwords Hardcoded

Medium

In the openIMIS environment, an attacker with access with these passwords can access confidential information.

GraphQL API, Introspection Enabled, Exposed GraphQL Development Console

Medium

An attacker can map out the API’s schema and gather information related to its configuration. This could lead to further attacks and potential loss of sensitive information.

Cookie Without SECURE flag

Low

To exploit this vulnerability, an attacker must be suitably positioned to eavesdrop on the victim's network traffic. Note that an advanced adversary could potentially target any connection made over the Internet's core infrastructure.