New Features 2017Project Type: software

New Features 2017

Uploaded image for project: 'New Features 2017'
  1. New Features 2017
  2. NF-2714

Vulnerability Assessment and Penetration Testing for Workterra on Azure US environment.

    Details

    • Type: Task
    • Status: To Do
    • Priority: Medium
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: UI Refresh
    • Labels:
      None
    • Module:
      BenAdmin
    • Reported by:
      Harbinger
    • Issue Importance:
      Q2
    • Severity:
      Simple

      Description

      Vulnerability Assessment and Penetration Testing for Workterra Web Application

      Environment : Azure US
      Company : Beta Security Test
      Modules : BenAdmin
      Execution : Manual + Tools (ZAP, Tamper Data, SQLMap)

      • Vulnerability Assessment and Security Testing of
        WORKTERRA web application
        selected static and dynamic pages
        Testing between SA,Partner,CA,Employee user roles
      • Application Security Verification Standard:
        o Authentication
        o Session Management
        o Access Control
        o Malicious Input Handling
        o Error Handling and Logging
        o Data Protection
        o Communications Security
        o Malicious Controls
        o File and Resource
      • Comparison to OWASP Top 10 List
      • Verification of Last Years bug fixes

      CC : Rakesh RoySamirVijayendra ShindeBharti Satputeshyam sharmaVijay Siddha

        Attachments

          Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. NF-2334 All Company- Employee Login - URL parameters - Security - URL parameters in all the SSM pages,reports are displayed in plain text.

          • High - Serious problem that could block progress.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. NF-2965 [Security]-[Authorization Failure]-[Azure] Employee can access all Admin pages over the URL and able to update the customization/settings for those pages.

          • High - Serious problem that could block progress.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. NF-3852 [Security] All Company - EE Login - Enroll Now - Request parameters values on Enroll Now page get altered and can be saved successfully.

          • High - Serious problem that could block progress.
          • In LB Testing

          Bug - A problem which impairs or prevents the functions of the product. WT-9842 [Security]-[Authorization Failure] Employee & Company Admin can access the 'Dashboard Configuration' page over the URL.

          • Medium - Has the potential to affect progress.
          • In Development

          Bug - A problem which impairs or prevents the functions of the product. WT-10522 [Security] [ZAP-Active Scan Alert] Cross Site Scripting attack reflected on Forgot Password Page.

          • High - Serious problem that could block progress.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. WT-10523 [Security] [ZAP-Active Scan Alert] Buffer Overflow error reported for images load request in Benadmin.

          • Medium - Has the potential to affect progress.
          • Rejected

          Bug - A problem which impairs or prevents the functions of the product. WT-10524 [Security] [ZAP-Active Scan Alert] Format String Error reported for LanguageName parameter.

          • Medium - Has the potential to affect progress.
          • Rejected

          Bug - A problem which impairs or prevents the functions of the product. WT-12172 [Security] [ZAP-Active Scan Alert] Remote OS Command Injection

          • Medium - Has the potential to affect progress.
          • Rejected

          Bug - A problem which impairs or prevents the functions of the product. WT-12173 [Security] [ZAP-Active Scan Alert] Buffer Over Flow issue

          • Medium - Has the potential to affect progress.
          • Rejected

          Bug - A problem which impairs or prevents the functions of the product. WT-12633 [Security] ZAP- Scan report Issue : Application Error Disclosure

          • Low - Minor problem or easily worked around.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. WT-12634 [Security] ZAP Scan reported Issue : X-Content-Type-Options Header Missing

          • Medium - Has the potential to affect progress.
          • Rejected

          Bug - A problem which impairs or prevents the functions of the product. WT-12635 [Security] ZAP Scan Issue : Incomplete or No Cache-control and Pragma HTTP Header Set

          • Low - Minor problem or easily worked around.
          • Rejected

          Bug - A problem which impairs or prevents the functions of the product. WT-12636 [Security] ZAP Scan Issues : Password Autocomplete in Browser

          • Medium - Has the potential to affect progress.
          • Rejected

          Bug - A problem which impairs or prevents the functions of the product. WT-12637 [Security] ZAP Scan Issue : Cookie No HttpOnly Flag

          • Low - Minor problem or easily worked around.
          • In Development

          Bug - A problem which impairs or prevents the functions of the product. WT-12639 [Security] ZAP Scan reported issue : Cross-Domain JavaScript Source File Inclusion

          • Medium - Has the potential to affect progress.
          • Open

            Activity

              People

              Assignee:
              jayshree.nagpure Jayshree Nagpure (Inactive)
              Reporter:
              prasadp Prasad Pise (Inactive)
              QA:
              Prasad Pise (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:

                  Time Tracking

                  Estimated:
                  Original Estimate - 80h Original Estimate - 80h
                  80h
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 403h
                  403h