계: Environment

이 섹션에는 소스 코드 외부에 있지만 제작 중인 제품의 보안에는 여전히 중요한 내용이 모두 포함되어 있습니다. 이 섹션에서 다루는 문제들은 소스 코드와 직접적으로 관련이 없기 때문에 나머지 섹션과 분리했습니다.

631 개 항목 찾음

취약점

ASP.NET Misconfiguration: Incomplete Role Protection

C#/VB.NET/ASP.NET

Abstract

공격자가 쿠키의 보호되지 않은 역할 정보를 보거나 수정할 수 있습니다.

Explanation

web.config에서 configuration/system.web/authentication/forms 요소의 cacheRolesInCookie 속성을 true로 설정하면 각 사용자에 대한 역할이 쿠키에 캐시됩니다. 이 정보가 일반 텍스트로 저장되면 응용 프로그램과 상호 작용하는 데 사용되는 시스템에 액세스할 수 있는 모든 사람이 쿠키에 저장된 정보에 액세스할 수 있습니다. 설상가상으로 공격자가 쿠키에 저장된 데이터를 임의로 수정할 수 있는 경우 응용 프로그램에 제공된 정보를 왜곡하고 공격자에게 유리하도록 동작을 수정할 수 있습니다.

대부분의 경우, 응용 프로그램이 사용된 컨텍스트에 따라 프로그래밍 방식으로 쿠키에서 입력을 확인할 수 있지만 ASP.NET 검증 프레임워크는 쿠키가 예상치 않게 수정되었음을 확인할 수 있는 탁월한 방법을 제공합니다. 이 방법이 아니면 모든 입력을 확인했다는 확신을 얻기가 어렵거나 때로는 불가능합니다.

References

[1] .NET Framework General Reference: CookieProtectionValue Property Microsoft Corporation

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 302

[8] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287

[9] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[10] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[11] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[12] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[13] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002418, CCI-002420, CCI-002421, CCI-002422

[14] Standards Mapping - FIPS200 MP, SC

[15] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[16] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-8 Transmission Confidentiality and Integrity (P1)

[17] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-8 Transmission Confidentiality and Integrity

[18] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[19] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[20] Standards Mapping - OWASP Top 10 2010 A9 Insufficient Transport Layer Protection

[21] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[22] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[23] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[24] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[25] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)

[26] Standards Mapping - OWASP Mobile 2014 M4 Unintended Data Leakage

[27] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1, Requirement 6.5.10

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.4

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1, Requirement 6.5.4

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1, Requirement 6.5.4

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1, Requirement 6.5.4

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1, Requirement 6.5.4

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1, Requirement 6.2.4

[36] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7.1 - Use of Cryptography

[37] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7.1 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[38] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7.1 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design, Control Objective C.4.1 - Web Software Communications

[39] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[60] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

[61] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.config.dotnet.asp_dotnet_misconfiguration_incomplete_role_protection

ASP.NET Misconfiguration: Information Disclosure

C#/VB.NET/ASP.NET

Abstract

ASP.NET 웹 서비스의 설명서 프로토콜이 활성화되어 있어 서비스를 오용하는 방법에 대한 정보가 공개될 수 있습니다.

Explanation

ASP.NET 웹 서비스는 웹 서비스와의 통신 방법을 설명하는 문서를 자동으로 생성하여 웹 서비스 클라이언트의 개발을 용이하게 합니다.

문서 프로토콜이 활성화된 웹 서비스는 브라우저 요청이 수신될 때 HTML 형식의 페이지를 생성합니다.

이 HTML 형식 페이지는 다음 정보를 설명합니다.
1. 지원되는 작업
2. 각 작업에서 수락하는 매개 변수
3. 해당 매개 변수로 전달되어야 하는 데이터 유형

문서 프로토콜은 XML 형식의 WSDL(웹 서비스 기술 언어) 파일도 생성합니다. 이 파일은 응용 프로그램이 웹 서비스에 대한 요청을 구성하는 방법을 이해할 수 있도록 설계되었습니다. 이 정보는 개발자, 특히 공용 웹 서비스용 클라이언트를 만드는 개발자에게 매우 유용할 수 있습니다. 그러나 개인 웹 서비스의 기능에 대한 자세한 정보를 공개하면 악의적인 공격자가 웹 서비스를 남용할 위험이 높아집니다. 문서 프로토콜은 항상 웹 서비스의 모든 함수와 매개 변수를 설명합니다. 이러한 함수의 일부만 공개적으로 액세스할 수 있도록 의도된 경우에도 마찬가지입니다.

References

[1] HOW TO: Disable the Documentation Protocol for ASP.NET Web Services

[2] HOW TO: Limit the Web Services Protocols that a Server Permits

[3] Web.config

[4] Web Services Settings Schema

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[10] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[13] Standards Mapping - OWASP Top 10 2013 A2 Broken Authentication and Session Management

[14] Standards Mapping - OWASP Top 10 2017 A2 Broken Authentication

[15] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[16] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[17] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[18] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[19] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[33] Standards Mapping - Web Application Security Consortium Version 2.00 Fingerprinting (WASC-45)

desc.configuration.dotnet.asp_dotnet_misconfiguration_information_disclosure

ASP.NET Misconfiguration: Missing Error Handling

C#/VB.NET/ASP.NET

Abstract

ASP .NET 응용 프로그램의 경우, 공격자가 프레임워크의 기본 제공 오류 응답에서 정보를 빼내는 것을 막기 위해 사용자 지정 오류 페이지를 사용해야 합니다.

Explanation

ASP .NET 응용 프로그램은 프레임워크 기본 페이지 대신 사용자 지정 오류 페이지를 사용하도록 구성되어야 합니다. 기본 오류 페이지는 발생한 오류에 대한 자세한 정보를 제공하므로 운영 환경에서 사용해서는 안 됩니다. <customErrors> 태그의 mode 속성은 사용자 지정 오류 페이지와 기본 오류 페이지 중 어느 것을 사용할지 결정합니다.

공격자는 기본 오류 페이지에서 얻은 자세한 정보를 이용하여 응용 프로그램이 사용하는 프레임워크, 데이터베이스 또는 기타 리소스를 공격할 수 있습니다.

References

[1] customErrors Element (ASP.NET Settings Schema) Microsoft

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 12

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001314, CCI-002420, CCI-003272

[9] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling

[12] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling

[13] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling

[14] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[15] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[16] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[18] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[19] Standards Mapping - OWASP Application Security Verification Standard 4.0 14.1.3 Build (L2 L3)

[20] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[21] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention

[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002480 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[54] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

[55] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.config.dotnet.asp_dotnet_misconfiguration_missing_error_handling

ASP.NET Misconfiguration: Missing HMAC Signature

C#/VB.NET/ASP.NET

Abstract

이 응용 프로그램은 암호화를 사용하도록 구성된 경우 ASP.NET에서 수행하는 서명 확인을 비활성화하는 속성을 설정합니다.

Explanation

기본적으로 ASP.NET은 ViewState, FormsAuth cookies 및 ScriptResource.axd URL과 같은 페이로드를 해독하기 전에 암호화 서명을 내부에서 검증하고 추가 처리를 위해 이러한 값을 응용 프로그램에 전달합니다. 그러나 aspnet:UseLegacyEncryption 설정을 사용하여 페이로드 해독 전에 암호화 서명 확인을 비활성화하도록 이 기능을 수정할 수 있습니다. 그러면 악성 클라이언트에서 암호화된 데이터를 해독, 위조 또는 변조할 수 있습니다.

예제 1: 다음 예에서, aspnet:UseLegacyEncryption이 true로 설정됩니다.


...
  <appSettings>
    <add key="aspnet:UseLegacyEncryption" value="true" />
  </appSettings>
...

References

[1] ASP.NET appSettings Element Microsoft

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 345

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002418, CCI-002420, CCI-002421, CCI-002422

[9] Standards Mapping - FIPS200 CM, SC

[10] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-8 Transmission Confidentiality and Integrity (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-8 Transmission Confidentiality and Integrity

[13] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[14] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[15] Standards Mapping - OWASP Top 10 2010 A9 Insufficient Transport Layer Protection

[16] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[19] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[20] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.5.3 Token-based Session Management (L2 L3), 13.2.6 RESTful Web Service Verification Requirements (L2 L3)

[21] Standards Mapping - OWASP Mobile 2014 M4 Unintended Data Leakage

[22] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1, Requirement 6.5.10

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1, Requirement 6.5.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1, Requirement 6.5.4

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1, Requirement 6.5.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1, Requirement 6.5.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1, Requirement 6.2.4

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7.1 - Use of Cryptography

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7.1 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7.1 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design, Control Objective C.4.1 - Web Software Communications

[34] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[55] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

[56] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.configuration.dotnet.asp_dotnet_misconfiguration_missing_hmac_signature

ASP.NET Misconfiguration: Password Protection Disabled

C#/VB.NET/ASP.NET

Abstract

암호를 일반 텍스트로 저장하거나 약한 암호화를 사용하면 시스템 침해가 발생할 수 있습니다.

Explanation

ASP.NET 응용 프로그램은 ASP.NET 응용 프로그램의 web.config 파일에 있는 <credentials> 요소에 사용자 이름과 암호 쌍을 저장할 수 있습니다. ASP.NET 응용 프로그램은 일반 텍스트, MD5 및 SHA1 암호 형식을 지원합니다.

일반 텍스트로 저장된 암호 또는 약한 암호화 알고리즘을 사용하는 암호는 응용 프로그램의 구성 파일에 액세스할 수 있는 모든 사람이 액세스할 수 있습니다. 여기에는 응용 프로그램이 호스팅되는 시스템 또는 응용 프로그램이 있는 소스 코드 리포지토리가 포함될 수 있습니다.

예제 1: 다음 web.config 항목은 암호를 일반 텍스트로 잘못 저장합니다.


<configuration>
  <system.web>
    <authentication>
      <forms protection="All">
	   <credentials passwordFormat="Clear">
   		<user name="user1" password="my_password"/>
		<user name="user2" password="my_password1"/>
        </credentials>
    	 </forms>
    </authentication>
  </system.web>
</configuration>

ASP.NET은 configuration/system.web/authentication/forms/credentials 요소의 passwordFormat 속성으로 지정되는 3가지 형식으로 저장된 자격 증명 암호를 지원합니다. 이 속성의 가능한 값은 다음과 같습니다.

Clear - 암호가 일반 텍스트로 저장되었음을 나타냄(최소 보안)
MD5 - 암호의 MD5 해시가 저장되었음을 나타냄
SHA1- 암호의 SHA1 해시가 저장되었음을 나타냅니다(최고 보안).

MD5 해시는 일반 텍스트보다 안전하지만 연구원들은 MD5 해시 알고리즘에 대한 무차별 대입 공격을 발견했습니다. 이런 경우더라도 SHA1 해시는 그러한 공격에 대해 적절한 보호를 제공합니다.

References

[1] credentials Element for forms for authentication (ASP.NET Settings Schema) Microsoft Corporation

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 260

[8] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287

[9] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287, [18] CWE ID 522

[10] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287, [21] CWE ID 522

[11] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[12] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[13] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000196, CCI-001199

[14] Standards Mapping - FIPS200 MP

[15] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[16] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-28 Protection of Information at Rest (P1)

[17] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-28 Protection of Information at Rest

[18] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage

[19] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage

[20] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[21] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[22] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[23] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[24] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[25] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.10.1 Service Authentication Requirements (L2 L3), 2.10.2 Service Authentication Requirements (L2 L3), 2.10.3 Service Authentication Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)

[26] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[27] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 3.4, Requirement 6.5.8, Requirement 8.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 3.4, Requirement 6.3.1.3, Requirement 6.5.8, Requirement 8.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 3.4, Requirement 6.5.3, Requirement 8.4

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 3.4, Requirement 6.5.3, Requirement 8.2.1

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 3.5.1, Requirement 6.2.4, Requirement 8.3.1

[36] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7.1 - Use of Cryptography

[39] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II, APP3340 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II, APP3340 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II, APP3340 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II, APP3340 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II, APP3340 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II, APP3340 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II, APP3340 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001740 CAT I, APSC-DV-002330 CAT II

[60] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

[61] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.config.dotnet.asp_dotnet_misconfiguration_password_protection_disabled

ASP.NET Misconfiguration: Request Validation Disabled

C#/VB.NET/ASP.NET

Abstract

ASP.NET 검증 프레임워크를 사용하여 확인되지 않은 입력으로 인한 취약점을 방지하십시오.

Explanation

확인되지 않은 입력은 ASP.NET 응용 프로그램 취약점의 주된 원인입니다. 확인되지 않은 입력은 Cross-Site Scripting, Process Control, SQL Injection 등 수많은 취약점을 야기할 수 있습니다.

이러한 공격을 방지하려면 ASP.NET 검증 프레임워크를 사용하여 응용 프로그램이 처리하기 전에 모든 프로그램 입력을 확인합니다.

검증 프레임워크의 사용 예에는 다음을 확인하는 것이 포함됩니다.

- 전화 번호 필드에는 전화 번호로서 유효한 문자만 사용합니다.

- 부울 값은 "T" 또는 "F"뿐입니다.

- 자유 형식 문자열은 적절한 길이와 구성을 유지합니다.

References

[1] Building Secure ASP.NET Pages and Controls Microsoft

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.5

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 554

[8] Standards Mapping - Common Weakness Enumeration Top 25 2019 [3] CWE ID 020

[9] Standards Mapping - Common Weakness Enumeration Top 25 2020 [3] CWE ID 020

[10] Standards Mapping - Common Weakness Enumeration Top 25 2021 [4] CWE ID 020

[11] Standards Mapping - Common Weakness Enumeration Top 25 2022 [4] CWE ID 020

[12] Standards Mapping - Common Weakness Enumeration Top 25 2023 [6] CWE ID 020

[13] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754

[14] Standards Mapping - FIPS200 CM

[15] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[16] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[17] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[18] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[19] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[21] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[22] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[23] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[24] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.1.3 Input Validation Requirements (L1 L2 L3), 5.1.4 Input Validation Requirements (L1 L2 L3), 14.1.3 Build (L2 L3)

[25] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[26] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[36] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[37] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[38] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I

[54] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I

[55] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I

[56] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I

[57] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I

[58] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002560 CAT I

[59] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.config.dotnet.asp_dotnet_misconfiguration_request_validation_disabled

ASP.NET Misconfiguration: Role Protection Disabled

C#/VB.NET/ASP.NET

Abstract

공격자가 쿠키의 보호되지 않은 역할 정보를 보거나 수정할 수 있습니다.

Explanation

References

[1] .NET Framework General Reference: CookieProtectionValue Property Microsoft Corporation

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark complete

[7] Standards Mapping - Common Weakness Enumeration CWE ID 302

[8] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287

[9] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[10] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[11] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[12] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[13] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002418, CCI-002420, CCI-002421, CCI-002422

[14] Standards Mapping - FIPS200 CM, SC