【BlackDuck】2024年软件漏洞洞察报告基于20万次web应用安全扫描数据

$DUCK·

2024

SoftwareVulnerabilitySnapshot

InsightsintoCriticalVulnerabilitiesfromover200,000ApplicationSecurityScansbyBlackDuck

Tableofcontents

ExecutiveSummary 1

AboutBlackDuck 1

KeyFindings 1

PotentialBusinessImpactSuggestedbytheData 3

Recommendations 4

IndustrySectorsRepresentedinThisReport 5

FundamentalsofDynamicApplicationSecurityTesting 6

KeyCharacteristicsofDAST 6

DASTintheModernSecurityLandscape 6

DASTandOtherTestingMethodologies 6

DASTinPreproductionandProduction 7

VulnerabilityLandscapeAnalysis 8

Top10VulnerabilityClassesIdentified 8

Critical-RiskandUrgentVulnerabilities 10

OWASPTop10CategoryAnalysis 11

Industry-SpecificVulnerabilityTrends 12

TheInterplayofDAST,SAST,andSCA 15

ComparativeStrengthsinDetectingSpecificVulnerabilities 15

SynergiesBetweenTestingMethodologies 16

Conclusion 17

BlackD

ExecutiveSummary

Thisreportanalyzesdatafromover200,000dynamicapplicationsecuritytesting(DAST)scansconductedbyBlackDuckonapproximately1,300applicationsacross19industrysectorsfromJune2023toJune2024.

Thefindingsprovideinsightsintothecurrentstateofsecurityforweb-basedapplicationsandsystems,andthepotentialimpactofsecurityvulnerabilitiesonbusinessoperationsinhigh-risksectorssuchasFinance,Insurance,andHealthcare.

ThereportalsoexamineshowDASToffersacrucialcomplementtoothersecuritytestingmethods,suchasstaticapplicationsecuritytesting(SAST)andsoftwarecompositionanalysis(SCA),andprovidesauniqueperspectiveonapplicationsecuritybymimickingreal-worldattackscenarios.

AboutBlackDuck

FormerlytheSynopsysSoftwareIntegrityGroup,BlackDuckoffersthemostcomprehensive,powerful,

andtrustedportfolioofAppSecsolutionsintheindustry.Wehaveanunmatchedtrackrecordofhelping

organizationssecuretheirsoftwarequickly,integratesecurityefficientlyintheirdevelopmentenvironments,andsafelyinnovatewithnewtechnologies.

KeyFindings

TheVulnerabilityLandscape

Atotal96,917vulnerabilitieswereidentifiedinscansconducted2023–24.Thesearethetopcritical-riskvulnerabilitiesidentified.

InjectionVulnerabilities

Thisisatypeofsecurityvulnerabilitythatallows

anattackertoinsertmaliciouscodeorcommandsintoanapplication,trickingitintoexecuting

unintendedactionsoraccessingdatawithoutproperauthorization.Theanalysisfound4,814Injection

vulnerabilities,withahighprevalenceof59%per

client.Thiscategoryhadthesecond-highestnumberofcriticalvulnerabilities(2,491),indicatingits

potentialforcausingseveresecuritybreaches.

CryptographicFailures(SensitiveDataExposure)Theseareweaknessesinhowanapplication

securessensitiveinformation.Thiscategory

includesissueslikenotencryptingimportantdata

whenit’sbeingsentovertheinternet,usingoutdatedorweakencryptionmethods,andfailingtoproperlyprotectpasswordsorothersecretinformation.

Thesefailurescanleadtodatabreaches,where

attackerscanstealortamperwithsensitive

informationsuchaspersonaldetails,financialdata,orlogincredentials.

Injectionvulnerabilitiesoftenoccurwhenuser

inputisnotproperlyvalidatedorsanitizedbefore

beingusedindatabasequeries,operatingsystem

commands,orwebpagecontent.CommonInjectionattacksincludeSQLInjection,CommandInjection,andCross-SiteScripting(XSS),withsuccessful

attacksleadingtodatatheft,unauthorizeddatamanipulation,orevenfullsystemcompromise.

TopreventInjectionvulnerabilities,organizations

needtoimplementproperinputvalidation,use

parameterizedqueries,andfollowsecurecoding

practices.WhilebothSASTandDASTcandetect

Injectionvulnerabilities,DASTisparticularlyeffectiveatidentifyingcomplex,runtime-dependentissues.

Regularsecuritytesting,especiallyusingDAST,canhelpidentifyandaddressthesevulnerabilities.

Thiscategoryofweaknesswasfoundtobe

widespreadinourDASTanalysis,affecting86%ofclientsandaccountingfor30,726vulnerabilities,

including4,882critical-riskinstances.Thismakes

itoneofthemostcommonandserioussecurity

issuesacrossindustries.Toaddressthese

vulnerabilities,organizationsneedtoimplement

strongencryptionpractices,useup-to-datesecurityprotocols,andensurethatsensitivedataisproperlyprotectedbothwhenit’sbeingtransmittedandwhenit’sstored.

BlackD|1

BlackD|2

Industry-SpecificInsights

High-risksectorsincludedFinanceandInsurance(1,299criticalvulnerabilities),Healthcareand

SocialAssistance(992criticalvulnerabilities),andInformationServices(446criticalvulnerabilities).TheFinanceandInsuranceindustry(FSI)hadthehighestnumberofcriticalvulnerabilitiesacrossallsitecomplexities,with565criticalvulnerabilitiesidentifiedforsmallFSIsites,580formediumsites,and154forlargesites.Thenext-highestindustrywasHealthcareandSocialAssistance,with367,486,and139criticalvulnerabilitiesforsmall,

medium,andlargesitesrespectively.

Thedataindicatesthatsmallandmedium-sizedsitestendtohavemorecriticalvulnerabilitiesthanlargersites,particularlyintheFSIsector.

Time-to-CloseAnalysis

Thedatashowssignificantvariationsacross

industrieswhenitcametovulnerabilitytime-to-

close.Forcriticalvulnerabilities,theUtilitiesindustryhadthelongesttime-to-closeacrossallsites.Theextendedtime-to-closeforsmall(107days)and

medium(876days)sitesversuslarger(1day)intheUtilitiessectormaybeduetolimitedcybersecurityresourcesandbudgetconstraints.Utilitiesoften

operatewithlegacysystemsthataredifficultto

patchandupdate.Largesitesmighthavededicatedsecurityteamsandmorerobustprocesses,allowingthemtoaddressvulnerabilitiesmorequickly.

Thenext-longesttime-to-closewastheEducationalServicessectorwithclosuretimesas342daysforsmallsites,111daysformediumsites,and1dayforlargesites.Smalleducationalinstitutionsoftenfacebudgetlimitationsandmaylackdedicated

cybersecuritypersonnel,leadingtolongertimestoaddressvulnerabilities.Largeeducational

institutionssuchasmajoruniversities,however,arelikelytohavebetter-fundedITdepartmentsandmoreresourcestoquicklymitigatecriticalvulnerabilities.

Conversely,FinanceandInsuranceclosedcritical

vulnerabilitiesforsmallsitesinjust28days,mediumsitesin53days,andlargesitesin78days.This

sectorisheavilyregulatedanddealswithhighly

sensitivedata,necessitatingarapidresponseto

vulnerabilities.Theseorganizationstypicallyhavesubstantialcybersecuritybudgetsanddedicated

teamstoensurecompliancewithregulationslikePaymentCardIndustryDataSecurityStandard(PCIDSS)andtoprotectfinancialdata.

OrganizationsintheHealthcareandSocial

Assistancesectortookanaverageof87daysto

closecriticalvulnerabilitiesforsmallsites,30daysformediumsites,and20daysforlargesites.TheHealthcaresectorisalsohighlyregulated(e.g.,theHealthInsurancePortabilityandAccountabilityAct[HIPAA])andhandlessensitivepatientdata,whichdrivestheneedforpromptvulnerabilityremediation.LargerHealthcareorganizationsoftenhavemore

resourcesanddedicatedsecurityteams,enablingfasterclosuretimes.

Thevariationsintime-to-closemetricsacross

differentsectorshighlighttheimpactofresource

allocationandthechallengeslegacysystemscan

haveonsecurityinitiatives.Sectorswithsignificantregulatorypressuresandsensitivedatatendtoactswiftlytomitigatevulnerabilities,reflectingtheir

proactivestance.Ontheotherhand,sectorswith

limitedresourcesandbudgetconstraintsfacelongerexposuretimes,underscoringtheneedfortailoredcybersecuritystrategiesandincreasedinvestmentinunder-resourcedindustries.

BlackDuckanalystsuseaproprietarymetrictoranktherelative“sitecomplexity”of

applicationsassessedbyBlackDuck®ContinuousDynamicscanning.Thismetricisbased

onthenumberandsophisticationofinteractionsperformedduringthescanningprocess.

Applicationswithlesscomplexitymayhaveminimalinteractivityandasimplecrawltree—thatis,anapplicationwithastraightforwardstructureofURLs.Higher-complexityapplicationsmayhavemanyinteractiveelementsanddynamicallygeneratedcontent.

Thismetricallowsourspecialiststocustomizescanbehaviors,adjustingthedepthand

aggressionofscansbasedonthecomplexityoftheapplication.Thecomplexitymetriccanalsobeweightedacrossindustriesforcomparisonandbaselining.

BlackD|3

PotentialBusinessImpactSuggestedbytheData

Thesearesomeoftherisksofthesevulnerabilities.

DataBreaches:SensitiveDataExposureand

Injectionvulnerabilitiesposesignificantthreats

tosensitivedataacrossallindustries,potentially

leadingtodataleaks,fines,financiallosses,and

reputationaldamage.SensitivedataatriskincludespersonallyidentifiableinformationsuchasSocialSecuritynumbers,bankinginformation,login

credentials,creditcardnumbers,medicalrecords,andtradesecrets.

RegulatoryNoncompliance:High-risksectorsfaceincreasedexposuretononcompliancewithdata

protectionregulations,riskingseverepenalties.Forexample,theCyberIncidentReportingforCritical

InfrastructureActof2022(CIRCIA)appliestocriticalinfrastructuresectors(includingFSI,Healthcare,

andWasteManagementamongothers)and

requirescoveredentitiestoreportcoveredcyberincidentsandransomwarepaymentstoCISA.

PCIDSSappliestoallorganizationsthathandlecreditcardinformationandmandatessecuritystandardsforprotectingcardholderdata.HIPAArequiresprotectionofpatienthealthinformationandmandatesreportingofdatabreaches.FororganizationshandlingthedataofEUcitizens,theGeneralDataProtectionRegulation(GDPR)

requiresstrictdataprotectionmeasuresandbreach

reporting.

OperationalDisruptions:Widespreadsecurity

misconfigurationsandDenial-of-Service

vulnerabilitiesacrossindustrysectorsthreatenbusinesscontinuityandserviceavailability.

Operationaldisruptionscausedbyvulnerabilitiesandmisconfigurationscanhavesignificant

consequencesacrosssectors.IntheHealthcaresectorforexample,someofthepotentialcriticaldisruptionsinclude

•DisruptionofLife-SavingEquipment:A

cyberattackthattargetsahospital’snetworkcouldleadtotheshutdownofcriticalmedicaldevices

suchasventilators,infusionpumps,andheart

monitors.Patientsrelyingonthesedevicesfor

lifesupportcouldfaceimmediatelife-threateningsituations.Forexample,ifventilatorsareturnedoff,patientswhocannotbreatheindependentlymay

sufferseverehealthconsequencesorevendeath.

•CompromiseofElectronicHealthRecords:A

ransomwareattackthatencryptspatientrecordswouldmaketheminaccessibletohealthcare

providers.Theinabilitytoaccesspatienthistories,medicationrecords,andtreatmentplanscould

leadtodelaysincare,incorrecttreatments,andmedicationerrors.Thiscanseverelyimpact

patientoutcomes,particularlyinemergencysituationswheretimelyaccesstoaccurateinformationiscritical.

•MedicationErrorsDuetoPharmacySystem

Interruptions:Anexploitedvulnerabilityina

pharmacysystemcouldcausethesystemto

gooffline.Interruptionsinthepharmacysystemcanleadtodelaysindispensingmedications,

incorrectdosages,ormissedtreatments.Thiscanbeparticularlydangerousforpatientswithcriticalconditionsrequiringprecisemedicationmanagement.

ExtendedVulnerabilityExposure:LongclosuretimesinsectorslikeUtilitiesandEducational

Servicesincreasetheriskofexploitationandpotentialbusinessimpact.Forexample,a

vulnerabilityinthepowergridcontrolsystem

thatremainsunpatchedcouldleadtoprolonged

poweroutagesaffectingmillionsofhouseholds

andbusinesses.Inextremecases,itcouldresult

incascadingfailuresacrossinterconnectedpowersystems,potentiallycausingblackoutsacrossentireregions.Avulnerabilityinawatertreatmentplant’scontrolsystemgoingunaddressedcouldpotentiallyalterchemicaltreatmentprocesses,leadingtowatercontamination.Thiscouldresultinwidespread

illness,theneedforextensivesystemflushing,andalossofpublictrustinwatersafety.

IntheEducationalServicessector,anunaddressedvulnerabilityinastudentinformationsystem

couldleadtotheexposureofsensitivestudent

data,includingpersonalinformation,academic

records,andfinancialdetails.Suchabreach

couldresultinidentitytheft,academicfraud,andviolationofprivacylawslikeFERPA,leadingtolegalconsequencesandlossoftrustintheinstitution.

Recommendations

Basedonthefindingsdatafromtheover200,000scansconductedbyBlackDuck,organizations

shouldprioritizeaddressingSensitiveDataExposure(calledCryptographicFailuresintheOWASP2021taxonomy)andInjectionvulnerabilities,includingSQLInjectionandCross-SiteScripting,especiallyinhigh-risksectors.

Organizationsinallsectorsshouldfocusonreducingtime-to-closeforcriticalvulnerabilities,particularlyinsectorsthatpermitlongremediationtimes.Securitymisconfigurationsacrossallindustriesshould

beaddressedtominimizepotentialinformationdisclosureandreputationaldamage.

Overall,developmentandsecurityteamsshouldimplementamultifacetedsecurityapproach

integratingDAST,SAST,andSCAtoachievethemostcomprehensivecoveragethroughoutthesoftwaredevelopmentlifecycle.Thefindingsindicatethatifsuchafullspectrumapproachtoapplication

securitytestingwereapplied,potentialexposuretocriticalvulnerabilitieswouldbemarkedlyreduced.

BlackDuck|

BlackD|5

IndustrySectorsRepresentedinThisReport

Construction

Mining/Quarrying,Oil/GasExtraction

WholesaleTrade

Agriculture,Forestry,FishingandHunting

Managementof

Companies&Enterprises

Manufacturing

RealEstateRentalandLeasing

AdministrativeSupport&WasteManagement

EducationalServices

AccommodationandFoodServices

FinanceandInsurance

Arts,Entertainment,andRecreation

InformationServices

OtherServices

HealthcareandSocialAssistance

Professional,Scientific,andTechnicalServices

PublicAdministration

TransportationandWarehousing

Utilities

RetailTrade

BlackD|6

FundamentalsofDynamicApplicationSecurityTesting

DASTisacriticalcomponentintheapplication

securitylandscape,particularlyasorganizations

grapplewithincreasinglycomplexandvulnerablewebapplications.Thissectionprovidesa

comprehensiveoverviewofDAST,itssignificance,anditsroleinarobustapplicationsecuritystrategy.

KeyCharacteristicsofDAST

DASTisablack-boxsecuritytestingmethodology

thatanalyzesapplicationsintheirrunningstate,

withoutanyprivilegedaccesstothatapplication’s

design,architecture,orinternals.UnlikeSAST,

whichexaminessourcecode,DASTsimulates

real-worldattacksonaliveapplication,identifying

vulnerabilitiesthatmaymanifestonlyduringruntimeorininteractionsbetweenmultiplesubsystems.

ThisapproachallowsDASTtodetectissuessuchasauthenticationproblems,serverconfigurationerrors,andCross-SiteScriptingvulnerabilitiesthatmightbemissedbyothertestingmethods.

DASTintheModernSecurity

Landscape

TherelevanceofDASThasgrownsignificantlyduetoseveralfactors.

•Theincreasingcomplexityofwebapplications:Withtheriseofthemicroservicesarchitecture,API-drivendevelopment,andcloud-native

applications,attacksurfaceshaveexpandedconsiderably.

•Evolvingcyberthreats:Asattackersbecomemoresophisticated,DAST’sabilitytosimulatereal-worldattacksbecomesinvaluable.

•Regulatorycompliance:RegulatoryframeworkslikeGDPRandPCIDSSrequirerobust,continuoussecuritytesting,makingDASTanessentialtoolforcompliance.

•DevSecOpsintegration:DAST’sabilitytobe

integratedwithincontinuousintegration/

continuousdeployment(CI/CD)pipelinesalignswithmodernDevSecOpspractices.

•Costimplications:Earlydetectionof

vulnerabilitiescansignificantlyreducethecostoffixingsecurityissuesafterdeployment.

DASTandOtherTestingMethodologies

WhileDASTispowerful,it’smosteffectivewhen

usedinconjunctionwithothersecuritytesting

methods.Forexample,SAST’sstrengthsinclude

earlydetectionofcodingflaws,butitmaymiss

runtimevulnerabilitiesorunintendedinteractions

betweencomponents,whichcanbefoundbyDAST.Likewise,SCAidentifiesvulnerabilitiesinthird-partycomponents;DASTcanverifyifthesevulnerabilitiesareexploitableinarunningapplication.

ByimplementingDASTinconjunctionwith

othertestingmethodologies,organizationscansignificantlyenhancetheirsecuritypostureinacomplexonlineapplicationlandscape.

ThekeycharacteristicsofDASTinclude

•Externalperspectivetesting,mimickinganattacker’sview

•Visibilityintotrendingbehaviors

•Runtimeanalysisofapplications

•Continuoustesting

•Abilitytotestwithoutaccesstosourcecode

•Developer-friendliness:IntegrationwithIDEsandCI/CDpipelinesmakessecuritytestinganaturalpartofthedevelopmentprocess.

•Compliance:Manyregulatorystandardspreferorrequiretestingbeforeproductiondeployment.

•Comprehensivetesting:Preproduction

environmentsenablemorethoroughand

aggressivetestingwithoutfearofimpactingusersordata.

DASTtestinginproductioncanalsobebeneficialinseveralscenarios.

•Continuoussecurityvalidation:Itcanactasanadditionallayerofsecuritytocatchanyissuesthatmighthaveslippedthroughpreproductiontesting.

•Detectionofemergingthreats:DASTcanautomaticallydetectemergingthreats.

•Cloud-nativeapplications:Itisusefulin

productionenvironmentsthatmayhaveuniqueconfigurationsthataredifficulttoreplicateintesting.

•Legacysystems:ProductionDASTmaybemoreeffectivedealingwitholderapplicationsthatlackcomprehensivepreproductionenvironments.

ThestrategicimplementationofDASTinboth

preproductionandproductionenvironments

offersabalancedapproach,allowingforthoroughtestingwithoutcompromisingsystemintegrity

oruserexperience.Thismultifacetedstrategy

notonlyenhancesvulnerabilitydetectionacross

variousstagesoftheapplicationlifecyclebutalsoaddressestheuniquechallengesposedbydiverseapplicationarchitectures,fromlegacysystemstocloud-nativeapplications.Ultimately,thisapproachenablesorganizationstobuildamoreresilient

securityposturecapableofadaptingtotheevolvingthreatlandscape.

DASTinPreproductionandProduction

DASTsolutionscanbeintegratedintoCI/CD

pipelinestoidentifyvulnerabilitiesearly,acceleratingremediationandreducingthecostoffixes.This

approachisparticularlyvaluablefordetectingissuesthatmaymanifestonlyinarunningapplication,

suchascertaintypesofInjectionvulnerabilitiesorunexpectedinteractionsbetweenservicesandcomponents.

DASTsolutionsusedinproductionofferadditionalbenefits,especiallyfororganizationsdealing

withcomplex,dynamicapplicationsorthosein

highlyregulatedindustries.Thiscanalsoprovidecontinuousmonitoring,detectingvulnerabilities

thatmayariseduetoconfigurationchanges,newlydiscoveredexploits,orchangesintheapplication’sruntimeenvironment.It’sparticularlyvaluableforidentifyingissueswiththird-partycomponentsthatmaybecomevulnerableovertime,andforverifyingtheeffectivenessofpatches.

Acombinationofpreproductionandproduction

DASTtestingmayprovidethemostcomprehensivesecuritycoverageforsomeorganizations.TheidealscenariointhesecasesisimplementingextensivepreproductionDASTtesting,andusingproductiontestingasasupplementarymeasureratherthantheprimarysecuritystrategy.Thecombinationoffersbenefitsincluding

•Riskmitigation:Preproductiontestingeliminatestheriskofunplanneddowntimeordatacorruptioninliveenvironments.

•Cost-effectiveness:Fixingvulnerabilitiesearlierinthedevelopmentcycleistypicallymuchlessexpensivethanaddressingtheminproduction.

BlackD|7

BlackD|8

VulnerabilityLandscapeAnalysis

Theanalysisofover200,000DASTscansacrossapproximately1,300applicationsrevealsaconcerningvulnerabilitylandscape.Thissectiondelvesintothemostprevalentandcriticalvulnerabilities,their

2

3

4

5

6

7

8

9

10

distributionacrossindustries,andtheirpotentialimpactonbusinessoperations.

Top10VulnerabilityClassesIdentified

VulnerabilityClassDescription

Vulnerabilities

Identified

Insufficient

1

TransportLayer

Protection

Failuretoproperlyencryptdataintransit,allowinginterceptionandtampering.

30,712

MissingSecureHeaders

Absenceofimportant

HTTPsecurityheadersthathelpprotectagainst

variousweb-basedattacks.ExamplesincludeX-XSS-Protection

,X-Frame-Options,andContent-Security-Policy.

22,321

InformationLeakage

Unintentionalexposureofsensitiveinformationthrougherrormessages,comments,orotherapplicationresponsesthatcanbeleveragedby

attackerstogaininsightsintothesystem’sarchitectureorvulnerabilities.

8,097

Predictable

ResourceLocation

Resourcesorfilesbeingstoredinlocationsthatcanbeeasilyguessedorpredictedbyattackers,potentiallyallowingunauthorizedaccesstosensitiveinformationorfunctionality.

5,468

FrameableResource

Avulnerabilityinwhichawebpagecanbeembeddedinaniframeon

anothersite,potentiallyleadingtoclickjackingattacks.ThisoccurswhentheX-Frame-Optionsheaderismissingorimproperlyconfigured.

4,481

VulnerableLibrary

Theuseofthird-partylibrariesorcomponentswithknownsecurity

vulnerabilities,whichcanintroduceweaknessesintotheapplicationthatusesthem.

4,215

Fingerprinting

Attackersgaininginformationaboutthetechnologystack,versions,orconfigurationsofasystem,whichcanbeusedtoidentifypotentialvulnerabilitiesorplanmore-targetedattacks.

3,700

Cross-SiteScripting

Avulnerabilitythatallowsattackerstoinjectmaliciousscriptsintowebpagesviewedbyotherusers,potentiallyleadingtotheftofsensitive

informationorsessionhijacking.

2,415

Insufficient

Authorization

Inadequateaccesscontrolsthatallowuserstoperformactionsor

accessresourcesbeyondtheirintendedprivileges,oftenduetoimproper2,396

implementationofauthorizationchecks.

SusceptibilitytoBruteForce

Anattackmethodinwhichattackerssystematicallyattemptmanypasswordsorpassphraseswiththehopeofeventuallyguessingcorrectly,oftenexploitingweakpasswordpoliciesorlackofaccountlockoutmechanisms.

2,235

Figure1.Vulnerabilityfrequency

BlackD|9

Ouranalysisidentifiedatotalof96,917

vulnerabilities.Figure1showsthevulnerabilitiesidentifiedmostfrequently,andFigure2liststhepercentageofclientswitheachvulnerability.

InsufficientTransportLayerProtection,themostprevalentissue,exposesorganizationstodata

interceptionandtampering,potentiallyleadingtodatabreachesandcomplianceviolations.MissingSecureHeaders,thesecond-most-common

vulnerability,leavesapplicationssusceptibletovariousweb-basedattacks,underminingoverallsecurityposture.

InformationLeakageandPredictableResourceLocationrepresentsignificantvulnerabilitiesthatoftenprovideattackerswithaneasyentrypointintosystems.InformationLeakage,rankedthirdwith8,097identifiedvulnerabilities,involvestheunintentionalexposureofsensitiveinformation

througherrormessages,comments,orapplicationresponses.Thiscanprovideattackerswithvaluableinsightsintosystemarchitectureorvulnerabilities.

PredictableResourceLocation,fourthwith5,468vulnerabilities,occurswhenresourcesorfilesarestoredineasilyguessablelocations,potentiallyallowingunauthorizedaccesstosensitive

informationorfunctionality.

Boththesevulnerabilityclasseshighlightacommonissue:theinadvertentdisclosureofinformationthatcanbeleveragedbyattackers.Thesevulnerabilitiesareparticularlyconcerningbecausetheyoftenresultfromoversightorinadequatesecuritypractices

ratherthancomplextechnicalissues,makingthembothcommon,and,atleasttheoretically,more

straightforwardtoaddresswithpropersecurityawarenessandprotocols.

VulnerabilityClassPercentageofClientswithVulnerability

MissingSecureHeaders97%

InsufficientTransportLayerProtection87%

InformationLeakage66%

FrameableResource60%

VulnerableLibrary57%

InsufficientAuthorization50%

Fingerprinting46%

Cross-SiteScripting41%

ImproperInputHandling40%

PredictableResourceLocation35%

Figure2.Percentageofclientsexperiencingoneormoreofagivenvulnerabilityclass

Critical-RiskandUrgentVulnerabilities

Critical-Risk

VulnerabilitiesUrgentNeedofAttention

VulnerabilityClass

InsufficientTransportLayerProtection4,8822

Cross-SiteScripting2,2561

InformationLeakage

510

-

Cross-SiteRequestForgery

434

-

AbuseofFunctionality248