Reino: Environment

Esta sección incluye todo lo que está fuera del código fuente pero aun así es importante para la seguridad del producto que se está creando. Dado que todas las cuestiones incluidas en esta sección no están directamente relacionadas con el código fuente, las hemos separado de las demás secciones.

J2EE Misconfiguration: Missing Security Role

Java/JSP

Abstract

Una restricción de seguridad que hace referencia a un elemento role-name inexistente impide el acceso legítimo a todos los recursos que protege.

Explanation

La falta de un elemento security-role para un elemento role-name definido en un elemento auth-constraint podría indicar una configuración desactualizada.

Ejemplo 1: En el siguiente ejemplo se especifica un elemento role-name, pero no se define en un elemento security-role.


<security-constraint>
    <web-resource-collection>
         <web-resource-name>AdminPage</web-resource-name>
         <description>Admin only pages</description>
         <url-pattern>/auth/noaccess/*</url-pattern>
    </web-resource-collection>

    <auth-constraint>
        <description>Administrators only</description>
        <role-name>admin</role-name>
    </auth-constraint>

    <user-data-constraint>
        <transport-guarantee>INTEGRAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

References

[1] Sun Microsystems, Inc. Java Servlet Specification 2.4

[2] Standards Mapping - Common Weakness Enumeration CWE ID 684

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094

[4] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[5] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)

[6] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection

[7] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[8] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[9] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[10] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[11] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[12] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[13] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9

[15] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[16] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[17] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[18] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002400 CAT II

[38] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[39] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.config.java.j2ee_misconfiguration_missing_security_role