Web Applications Vulnerabilities

The Web Applications Vulnerabilities page offers a comprehensive look at vulnerabilities affecting web applications within an organization's digital environment. This page enables security teams to track and evaluate risks linked to subdomains and web interfaces, helping them identify and fix issues that could expose the organization to threats.

Web Applications Vulnerabilities

At the top of the page, there are filters for Domain and History which allow users to select the relevant domain and time period for the data displayed.

Domain and History

Overview of Web Application Exposure

This section provides a summarized view of vulnerability-related insights for the organization. It includes the following metrics:

1. Total Vulnerabilities: Displays the total number of vulnerabilities detected across the organization's external assets.

2. URLs: Indicates the total number of identified and analyzed URLs.

3. Web App Vulnerabilities: Highlights vulnerabilities specifically related to web applications.

4. Library Vulnerabilities: Shows vulnerabilities found in third-party libraries.

5. SSL Certificate Vulnerabilities: Represents weaknesses identified in SSL certificate implementations.

Overview of Web Applications

On the right side, the Vulnerabilities / Scans chart provides a graphical representation of the vulnerabilities identified across different scans.

Vulnerabilities / Scans

Web Application Vulnerabilities Summary

This section provides a detailed overview of identified web application vulnerabilities.

Key Metrics (Displayed on the Left Panel):

1. Web App Vulnerabilities:

   • A total of 28 vulnerabilities were detected in web applications.

2. SSL Certificate Vulnerabilities:

   • 2 vulnerabilities related to SSL certificates.

3. Library Vulnerabilities:

   • 1 vulnerability associated with third-party libraries.

Vulnerability Details (Displayed in the Table):

1. Reflected Cross Site Scripting (XSS)

   • URL: /blog

   • Severity: High

   • Description: Reflected XSS is a web security vulnerability that allows attackers to bypass the same-origin policy.

2. Spring4Shell

   • URL: /catalog/product/stock

   • Severity: High

   • Description: A critical vulnerability in Spring MVC or Spring WebFlux applications.

Application Vulnerabilities Summary

The Show button offers further details on the selected vulnerability.

Show Button

Upon clicking the "Show" button, users are directed to a detailed vulnerability page where specific information about the selected vulnerability is displayed.

1. URL and Category Type: At the top, users see the URL affected.

2. Description: A brief overview explains the purpose of the identified vulnerability.

3. References: A series of links that offer further reading and resources for users interested in understanding HTTP security headers better.

4. Remediations: This section provides general advice or steps for strengthening security.

5. Headers: A section (with a "Show" button) for examining specific HTTP headers associated with the vulnerability.

Detailed Vulnerability Page

SSL Certificate Vulnerabilities Overview

This page displays SSL Certificate Vulnerabilities detected within the system. It provides a detailed breakdown of affected assets, including their IP addresses, target hosts, ports, services, and the number of vulnerabilities.

Key Information Displayed:

1. IP Address:

   • Lists the specific IPs where SSL vulnerabilities have been identified.

2. Target Host:

   • The domain or hostname associated with the vulnerable SSL certificates.

3. Port:

   • 443 – This indicates that the vulnerabilities are linked to services running over HTTPS.

4. Service:

   • HTTP – Specifies that the identified vulnerabilities are related to web services operating via HTTP.

5. Vulnerabilities:

   • Displays the number of vulnerabilities per record, with each entry showing 1 vulnerability detected.

SSL Certificate Vulnerabilities

The Show button allows users to access detailed information about the specific SSL vulnerability, including descriptions, impact and recommended remediations.

More Details

Library Vulnerabilities Overview

This page focuses on Library Vulnerabilities detected within the organization's external-facing assets. It highlights specific libraries that contain known vulnerabilities, providing actionable insights for remediation.

Key Features:

1. Library Name:

   • Displays the name of the library where vulnerabilities have been identified.

2. Library Version:

   • Specifies the version of the library affected.

3. Affected Libraries:

   • Provides the file path for the affected library, helping pinpoint its location in the application.

4. Vulnerabilities:

   • Displays the total number of vulnerabilities associated with the library.

Library Vulnerabilities Overview

Each row includes a "View" button, enabling users to access detailed information about the vulnerabilities, including descriptions, severity, and recommended remediations.