Vulnerability Categories
The vulnerabilities found in the OWASP Juice Shop are categorized into several different classes. Most of them cover different risk or vulnerability types from well-known lists or documents, such as OWASP Top 10, OWASP ASVS, OWASP Automated Threat Handbook, OWASP API Security Top 10 and OWASP Top 10 Privacy Risks or MITRE’s Common Weakness Enumeration. The following table presents a mapping of the Juice Shop’s categories to OWASP, CWE and WASC threats, risks and attacks (without claiming to be complete).
Category Mappings
| Category | OWASP | CWE | WASC |
|---|---|---|---|
Broken Access Control |
|||
Broken Anti-Automation |
OWASP-AT-004, API4:2019, OWASP-AT-010, OAT-009, OAT-015, OAT-008 |
||
Broken Authentication |
|||
Cross Site Scripting (XSS) |
|||
Cryptographic Issues |
- |
||
Improper Input Validation |
|||
Injection |
|||
Insecure Deserialization |
- |
||
Miscellaneous |
- |
- |
|
Security Misconfiguration |
|||
Security through Obscurity |
- |
||
Sensitive Data Exposure |
|||
Unvalidated Redirects |
|||
Vulnerable Components |
- |
||
XML External Entities (XXE) |