A05: Security Misconfiguration · 2021

Insecure defaults, unnecessary services, excessive permissions, detailed messages or inconsistent settings create exploitable attack surfaces.

Summary

Insecure defaults, unnecessary services, excessive permissions, detailed messages or inconsistent settings create exploitable attack surfaces.

How the attack works

An attacker reaches an unnecessarily exposed service with insecure default access and gains control of the service.

Example

Vulnerable · Pseudocode

admin:
  public: true
  password: admin

Fix: Disable the public panel and remove default credentials.

Prevention

Automate hardened, repeatable configuration across all environments.
Remove unnecessary features, accounts and services.
Apply patches, security headers and continuous configuration reviews.

Lineage

2013 · A5: Security Misconfiguration Moves down to rank 6 in 2017
2017 · A4: XML External Entities (XXE) Integrated into Security Misconfiguration
2017 · A6: Security Misconfiguration Expanded with XXE in 2021
2021 · A05: Security Misconfiguration Absorbs XXE
2025 · A02: Security Misconfiguration Moves up from rank 5

2013:A5 → 2017:A6: Security Misconfiguration moves down one rank.
2017:A6 → 2021:A05: Security Misconfiguration moves up one rank.
2017:A4 → 2021:A05: XXE is integrated into Security Misconfiguration.
2021:A05 → 2025:A02: Security Misconfiguration moves up from rank 5 to 2.

Sources

Open official source ↗

Buy me a coffee