中国电信 EMA 服务管理平台二期扩容安全验收漏洞修复总结
目 录
1 WEB 安全介绍............................................................................................................................. 1
2 SQL 注入、盲注........................................................................................................................... 1
2.1 SQL 注入、盲注概述...................................................................................................................1
2.2 安全风险及原因..........................................................................................................................2
2.3 APPSCAN 扫描建议..........................................................................................................................2
2.4 应用程序解决方案......................................................................................................................4
3 会话标识未更新.......................................................................................................................... 7
3.1 会话标识未更新概述..................................................................................................................7
3.2 安全风险及原因分析..................................................................................................................8
3.3 APPSCAN 扫描建议..........................................................................................................................8
3.4 应用程序解决方案......................................................................................................................8
4 已解密登录请求.......................................................................................................................... 9
4.1 已解密登录请求概述..................................................................................................................9
4.2 安全风险及原因分析..................................................................................................................9
4.3 APPSCAN 扫描建议........................................................................................................................10
4.4 应用程序解决方案....................................................................................................................10
5 跨站点请求伪造........................................................................................................................ 12
5.1 跨站点请求伪造概述................................................................................................................12
5.2 安全风险及原因分析................................................................................................................14
5.3 APPSCAN 扫描建议........................................................................................................................14
5.4 应用程序解决方案....................................................................................................................14
6 不充分账户封锁........................................................................................................................ 14
6.1 不充分账户封锁概述................................................................................................................14
6.2 安全风险及原因分析................................................................................................................15
6.3 APPSCAN 扫描建议........................................................................................................................15
6.4 应用程序解决方案....................................................................................................................15
7 启用不安全 HTTP 方法............................................................................................................... 16
7.1 启用不安全 HTTP 方法概述......................................................................................................16
7.2 安全风险及原因分析................................................................................................................16
7.3 APPSCAN 扫描建议........................................................................................................................16
7.4 应用程序解决方案....................................................................................................................17
8 HTTP 注释敏感信息................................................................................................................... 17
8.1 HTTP 注释敏感信息概述...........................................................................................................17
8.2 安全风险及原因分析................................................................................................................18
8.3 APPSCAN 扫描建议........................................................................................................................18
- i -
评论0
最新资源