OK To Defer Low Severity Vulnerabilities?

Hemant Bansal | October 17, 2021

OK To Defer Low Severity Vulnerabilities?

Not if a black hat hacker can chain multiple low severity vulnerabilities together to create a critical/high severity vulnerability! We’ve seen several instances of this tactic with our customers recently Simple SSRF or CLRF can be combined with Unsafe serialization to lead to server takeover. Low severity self XSS can be combined with clickjacking leading to account takeover. Login/Logout CSRF, which exists in about 80% of the web apps we test, when combined with XSS affect account can lead to cookie stealing, which can be further exploited to hijack sessions.

OK To Defer Low Severity Vulnerabilities?

Discovery of the chained vulnerability requires manual testing, static/dynamic vulnerability testing is not sufficient.

We offer manual testing very economically with our certified ethical hackers, let us know if you’d like to receive an actual sample report, or for a free 24-hour test of your app.

Request a 24-hour Free Pen Test or actual sample report at security@apptroos.com  so you can see the high quality of our work & reports.

Latest Updates

December 17, 2021

Run More Frequent Pen Tests Economically

Some flaws, such as CSRF (Cross-Site Request Forgery) and other business logic vulnerabilities, require a human to be in the loop to exploit and verify the vulnerability. Only Manual testing […]

Learn More

October 17, 2021

OK To Defer Low Severity Vulnerabilities?

Discovery of the chained vulnerability requires manual testing, static/dynamic vulnerability testing is not sufficient. We offer manual testing very economically with our certified ethical hackers, let us know if you’d […]

Learn More

October 17, 2021

Top US Travel Site Secured From IDOR Vulnerability Before Exploitation

Recently apptroops found one weak spot in the Top US Travel website where the attacker could see the personal information of all the users. Have you ever noticed a parameter […]

Learn More

October 17, 2021

Brief Introduction On Devsecops

DevOps vs DevSecOps DevOps is an edge approach that overcomes any barrier been development and operations. It involves better-coordinated effort between all the supporters that deal with programming. In simple […]

Learn More

October 17, 2021

General Data Protection Regulation (GDPR)

What does the GDPR do? The General Data Protection Regulation (GDPR) is the hardest security and security law on the planet. In spite of the fact that it was drafted […]

Learn More

October 16, 2021

Is automated vulnerability testing enough?

Why not have white hat hackers verify systems have been correctly patched and test for flaws manually?  Well, in a word, it can be expensive.  One new company, apptroops, is doing it […]

Learn More

Leave Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Contact Us

    Write us a message

  • Request our free 24-Hour penetration test
    and get vulnerability report.

    • Evaluate skills before any type of engagement with Apptroops.
    • Level-1 Testing with manual approach in addition to static/dynamic.
    • Get a clear picture of root findings with mitigations in the report.
    • 90% of the time we find unknown hidden critical/ high vulnerabilities.
  • 1