Security Vulnerability Guide
This section lists important vulnerabilities applicable to modern API driven applications.
OWASP API Top 10
OWASP Web Top 10
| Rank | Vulnerability | CWE |
|---|---|---|
| A10 | Server Side Request Forgery | 918 |
Active Security Testing
This section lists dynamic and active security testing categories used to identify runtime vulnerabilities in APIs through simulated attack techniques.
| Category | CWE / Reference |
|---|---|
| CSRF | 352 |
| CORS Misconfiguration | 942 |
| API Fuzzing | 20 |
| Input Validation Issues | 20 |
| Denial of Service (DoS) | 400 |
| Rate Limiting Issues | 770 |
| Remote Code Execution | 94 |
| Local File Inclusion | 98 |
Miscellaneous
This section lists issues related to API security and resilience, but which cannot be purely categorized as security vulnerabilities.
| Issue | CWE |
|---|---|
| API Schema Non Conformance | 1215, 393 |
| Unexpected 5XX Server Errors | 600 |
| Undocumented Response Codes | 394 |
| Inadequate Response Headers | 838 |
| Incorrect Response Content Types | 838 |
| Incorrect Response Body | 838 |
Baseline
Baseline Security Controls are a minimum set of foundational controls that APIs should implement. These are based on security best practices.
This section lists vulnerabilities arising due to the violation of these security controls. A number of these issues are applicable to OWASP API A7.
Was this page helpful?