Content

1 Overview
2 Result Summary
- 2.1 Vulnerabilities
- 2.2 OWASP Top 10
3 Methodology
4 Detailed Results
5 Remediation
6 Report

Overview

Date	2022-09-14
Status	FIXED
Release	Release 2022-04
TestType	automatic
TestTopic	Penetration Test
Context	Project: Security 2022
Tester	SecurityOne
Standard

Result Summary

Vulnerabilities

Risk	Count
Critical	0
High	1
Medium	0
Low	3

extension

OWASP Top 10

A01	YES
A02	NO
A03	NO
A04	YES
A05	YES
A06	NO
A07	NO
A08	NO
A09	NO
A10	NO

Methodology

SecurityONE based the findings and recommendations presented in this report on manual and automatic web application vulnerability scanning and penetration testing against the web application.

Automatic web application scanning:
SecurityONE has used several commercial tools to analyze the target environment and identify potential vulnerabilities. Automatic scanning software identifies application-level vulnerabilities.
Web application manual testing:
Using the information generated by the automated testing software, SecurityONE also used manual testing techniques to identify and try to exploit additional vulnerabilities in the targeted application and to eliminate false positives caused by the automated scanning process. The assessment was conducted in accordance with best practices in the industry, defined by such methodologies as ISECOM's Open-Source Security Testing Methodology Manual (OSSTMM) and the Open Web Application Security Project (OWASP).

Detailed Results

Vulnerability	Risk	Impact	Status

Vulnerability	Risk	Impact
Broken Authorization	High	This allows a low privilege attacker to perform actions that a higher privilege user would normally have access to.
Default Passwords Hardcoded	Low	In a default implementation of an openIMIS environment, an attacker with access with these passwords can potentially access confidential information.
GraphQL introspection enabled	Low	An attacker can map out the API’s schema and gather information related to its configuration. This could lead to further attacks and potential loss of sensitive information.
Cookie Without SECURE flag	Low	To exploit this vulnerability, an attacker must be suitably positioned to eavesdrop on the victim's network traffic. Note that an advanced adversary could potentially target any connection made over the Internet's core infrastructure.

Remediation

All errors were fixed ( ) or rejected as not applicable ( ). No instances in countries were affected.

openIMIS

2022-09 Penetration Test