International Standard - ISO 27001:2013: Compliance Report

International Standard - ISO
27001:2013
Compliance Report
14 June 2019
Generated by Acunetix
Description
ISO/IEC 27001 is an information security management system (ISMS) standard published in September 2013 by the International
Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC
27001:2013 - Information technology - Security techniques - Information security management systems - Requirements.
The objective of this standard is to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining,
and improving an Information Security Management System.
Disclaimer
This document or any of its content cannot account for, or be included in any form of legal advice. The outcome of a vulnerability
scan (or security evaluation) should be utilized to ensure that diligent measures are taken to lower the risk of potential exploits
carried out to compromise data.
Legal advice must be supplied according to its legal context. All laws and the environments in which they are applied, are
constantly changed and revised. Therefore no information provided in this document may ever be used as an alternative to a
qualified legal body or representative.
Scan
URL http://192.168.1.207:8069/web/
Scan date 14/06/2019, 09:04:31
Duration 2 minutes, 59 seconds
Profile Full Scan
Compliance at a Glance
This section of the report is a summary and lists the number of alerts found according to individual compliance categories.
- Inventory of assets(8.1.1)
No alerts in this category
- Handling of assets(8.2.3)
Total number of alerts in this category: 1
- Access to networks and network services(9.1.2)

- Management of privileged access rights(9.2.3)

- Management of secret authentication information of users(9.2.4)

- Use of secret authentication information(9.3.1)

- Information access restriction(9.4.1)

- Secure log-on procedures(9.4.2)

- Password management system(9.4.3)

- Use of privileged utility programs(9.4.4)

- Access control to program source code(9.4.5)

- Separation of development, testing and operational environments(12.1.4)

- Controls against malware(12.2.1)
- Protection of log information(12.4.2)

- Administrator and operator logs(12.4.3)

- Installation of software on operational systems(12.5.1)

- Security of network services(13.1.1)

- Information transfer policies and procedures(13.2.1)

- Electronic messaging(13.2.3)
- Securing application services on public networks(14.1.2)

- Protecting application services transactions(14.1.3)

- Secure development policy(14.2.1)

- Protection of test data(14.3.1)

- Availability of information processing facilities(17.2.1)

- Protection of records(18.1.3)
- Privacy and protection of personally identifiable information(18.1.4)

- Regulation of cryptographic controls(18.1.5)

Compliance According to Categories: A Detailed Report
This section is a detailed report that explains each vulnerability found according to individual compliance categories.
(8.1.1)Inventory of assets
Assets associated with information and information processing facilities shall be identified and an inventory of these assets shall
be drawn up and maintained.
No alerts in this category.
(8.2.3)Handling of assets
Procedures for handling assets shall be developed and implemented in accordance with the information classification scheme
adopted by the organization.
Alerts in this category
Session token in URL
This application contains a session token in the query parameters. A session token is sensitive information and should not be
stored in the URL. URLs could be logged or leaked via the Referer header.
Base Score: 0.0

Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
Base Score: 7.5
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3 User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
CWE CWE-200
Affected item Web Server
Affected parameter
Variants Not available in the free trial
(9.1.2)Access to networks and network services
Users shall only be provided with access to the network and network services that they have been specifically authorized to use.
(9.2.3)Management of privileged access rights
The allocation and use of privileged access rights shall be restricted and controlled.
HTM L form without CSRF protection
This alert requires manual confirmation
Cross-Site Request Forgery (CSRF, or XSRF) is a vulnerability wherein an attacker tricks a victim into making a request the victim
did not intend to make. Therefore, with CSRF, an attacker abuses the trust a web application has with a victim's browser.
Acunetix found an HTML form with no apparent anti-CSRF protection implemented. Consult the 'Attack details' section for more
information about the affected HTML form.
Base Score: 2.6

Access Complexity: High
Integrity Impact: Partial
Base Score: 4.3
CVSS3 User Interaction: Required
Scope: Unchanged
Integrity Impact: Low
CWE CWE-352
Affected parameter
Login page password-guessing attack
A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an
attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you
discover the one correct combination that works.
This login page doesn't have any protection against password-guessing attacks (brute force attacks). It's recommended to
implement some type of account lockout after a defined number of incorrect password attempts. Consult Web references for more
information about fixing this problem.
Base Score: 5.0
Confidentiality Impact: Partial
Base Score: 5.3
Scope: Unchanged
Availability Impact: Low
CWE CWE-307
Affected parameter
(9.2.4)Management of secret authentication information of users
The allocation of secret authentication information shall be controlled through a formal management process.
(9.3.1)Use of secret authentication information
Users shall be required to follow the organization's practices in the use of secret authentication information.
Base Score: 5.0

Base Score: 5.3
Scope: Unchanged
CWE CWE-307
Affected parameter
(9.4.1)Information access restriction
Access to information and application system functions shall be restricted in accordance with the access control policy.
Base Score: 0.0

Base Score: 7.5
Scope: Unchanged
CWE CWE-200
Affected parameter
(9.4.2)Secure log-on procedures
Where required by the access control policy, access to systems and applications shall be controlled by a secure log-on
procedure.
(9.4.3)Password management system
Password management systems shall be interactive and shall ensure quality passwords.
Base Score: 5.0

Base Score: 5.3
Scope: Unchanged
CWE CWE-307
Affected parameter
(9.4.4)Use of privileged utility programs
The use of utility programs that might be capable of overriding system and application controls shall be restricted and tightly
controlled.
(9.4.5)Access control to program source code
Access to program source code shall be restricted.
(12.1.4)Separation of development, testing and operational environments
Development, testing, and operational environments shall be separated to reduce the risks of unauthorized access or changes to
the operational environment.
(12.2.1)Controls against malware
Detection, prevention and recovery controls to protect against malware shall be implemented, combined with appropriate user
awareness.
(12.4.2)Protection of log information
Logging facilities and log information shall be protected against tampering and unauthorized access.
Base Score: 0.0

Base Score: 7.5
Scope: Unchanged
CWE CWE-200
Affected parameter
(12.4.3)Administrator and operator logs
System administrator and system operator activities shall be logged and the logs protected and regularly reviewed.
Base Score: 0.0

Base Score: 7.5
Scope: Unchanged
CWE CWE-200
Affected parameter
(12.5.1)Installation of software on operational systems
Procedures shall be implemented to control the installation of software on operational systems.
Vulnerable Javascript library
You are using a vulnerable Javascript library. One or more vulnerabilities were reported for this version of the Javascript library.
Consult Attack details and Web References for more information about the affected library and the vulnerabilities that were
reported.
Base Score: 6.4

Base Score: 6.5
Scope: Unchanged
Confidentiality Impact: Low
CWE CWE-16
Affected parameter
reported.
Base Score: 6.4

Base Score: 6.5
Scope: Unchanged
CWE CWE-16
Affected parameter
Cookie(s) without HttpOnly flag set
This cookie does not have the HTTPOnly flag set. When a cookie is set with the HTTPOnly flag, it instructs the browser that the
cookie can only be accessed by the server and not by client-side scripts. This is an important security protection for session
cookies.
Base Score: 0.0

CWE CWE-16
Affected parameter
Cookie(s) without Secure flag set
This cookie does not have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie
can only be accessed over secure SSL channels. This is an important security protection for session cookies.
Base Score: 0.0

CWE CWE-16
Affected parameter
Base Score: 5.0

Base Score: 5.3
Scope: Unchanged
CWE CWE-307
Affected parameter
(13.1.1)Security of network services
Security mechanisms, service levels and management requirements of all network services shall be identified and included in
network services agreements, whether these services are provided in-house or outsourced.
(13.2.1)Information transfer policies and procedures

Formal transfer policies, procedures and controls shall be in place to protect the transfer of information through the use of all
types of communication facilities.
(13.2.3)Electronic messaging
Information involved in electronic messaging shall be appropriately protected.
(14.1.2)Securing application services on public networks
Information involved in application services passing over public networks shall be protected from fraudulent activity, contract
dispute and unauthorized disclosure and modification.
(14.1.3)Protecting application services transactions
Information involved in application service transactions shall be protected to prevent incomplete transmission, mis-routing,
unauthorized message alteration, unauthorized disclosure, unauthorized message duplication or replay.
(14.2.1)Secure development policy
Rules for the development of software and systems shall be established and applied to developments within the organization.
(14.3.1)Protection of test data
Test data shall be selected carefully, protected and controlled.
(17.2.1)Availability of information processing facilities
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
(18.1.3)Protection of records
Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release, in accordance with
legislatory, regulatory, contractual and business requirements.
Base Score: 0.0

Base Score: 7.5
Scope: Unchanged
CWE CWE-200
Affected parameter
(18.1.4)Privacy and protection of personally identifiable information
Privacy and protection of personally identifiable information shall be ensured as required in relevant legislation and regulation
where applicable.
Base Score: 0.0

Base Score: 7.5
Scope: Unchanged
CWE CWE-200
Affected parameter
(18.1.5)Regulation of cryptographic controls
Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations.

Affected Items: A Detailed Report
This section provides full details of the types of vulnerabilities found according to individual affected items.
Web Server
HTM L form without CSRF protection
This alert requires manual confirmation
Cross-Site Request Forgery (CSRF, or XSRF) is a vulnerability wherein an attacker tricks a victim into making a request the victim
did not intend to make. Therefore, with CSRF, an attacker abuses the trust a web application has with a victim's browser.
Acunetix found an HTML form with no apparent anti-CSRF protection implemented. Consult the 'Attack details' section for more
information about the affected HTML form.
This alert belongs to the following categories: 9.2.3
Base Score: 2.6

Access Complexity: High
Base Score: 4.3
CVSS3 User Interaction: Required
Scope: Unchanged
CWE CWE-352
Parameter Variations
reported.
Base Score: 6.4

Base Score: 6.5
Scope: Unchanged
CWE CWE-16
reported.
Base Score: 6.4

Base Score: 6.5
Scope: Unchanged
CWE CWE-16
Cookie(s) without HttpOnly flag set
This cookie does not have the HTTPOnly flag set. When a cookie is set with the HTTPOnly flag, it instructs the browser that the
cookie can only be accessed by the server and not by client-side scripts. This is an important security protection for session
cookies.
Base Score: 0.0

CWE CWE-16
Cookie(s) without Secure flag set
This cookie does not have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie
can only be accessed over secure SSL channels. This is an important security protection for session cookies.
Base Score: 0.0

CWE CWE-16
This alert belongs to the following categories: 9.2.3, 9.3.1, 9.4.3, 12.5.1
Base Score: 5.0

Base Score: 5.3
Scope: Unchanged
CWE CWE-307
This alert belongs to the following categories: 8.2.3, 9.4.1, 12.4.2, 12.4.3, 18.1.3, 18.1.4
Base Score: 0.0

Base Score: 7.5
Scope: Unchanged
CWE CWE-200
Scanned items (coverage report)
http://192.168.1.207:8069/
http://192.168.1.207:8069/web
http://192.168.1.207:8069/web/binary
http://192.168.1.207:8069/web/binary/company_logo
http://192.168.1.207:8069/web/database
http://192.168.1.207:8069/web/database/backup
http://192.168.1.207:8069/web/database/get_list
http://192.168.1.207:8069/web/database/manager
http://192.168.1.207:8069/web/database/selector
http://192.168.1.207:8069/web/proxy
http://192.168.1.207:8069/web/proxy/load
http://192.168.1.207:8069/web/session
http://192.168.1.207:8069/web/session/get_lang_list
http://192.168.1.207:8069/web/session/get_session_info
http://192.168.1.207:8069/web/static
http://192.168.1.207:8069/web/static/lib
http://192.168.1.207:8069/web/static/lib/backbone
http://192.168.1.207:8069/web/static/lib/backbone/backbone.js
http://192.168.1.207:8069/web/static/lib/bootstrap
http://192.168.1.207:8069/web/static/lib/bootstrap/css
http://192.168.1.207:8069/web/static/lib/bootstrap/css/bootstrap.css
http://192.168.1.207:8069/web/static/lib/bootstrap/fonts
http://192.168.1.207:8069/web/static/lib/bootstrap/js
http://192.168.1.207:8069/web/static/lib/bootstrap/js/bootstrap.js
http://192.168.1.207:8069/web/static/lib/cleditor
http://192.168.1.207:8069/web/static/lib/cleditor/images
http://192.168.1.207:8069/web/static/lib/cleditor/jquery.cleditor.css
http://192.168.1.207:8069/web/static/lib/cleditor/jquery.cleditor.js
http://192.168.1.207:8069/web/static/lib/datejs
http://192.168.1.207:8069/web/static/lib/datejs/core.js
http://192.168.1.207:8069/web/static/lib/datejs/extras.js
http://192.168.1.207:8069/web/static/lib/datejs/globalization
http://192.168.1.207:8069/web/static/lib/datejs/globalization/en-US.js
http://192.168.1.207:8069/web/static/lib/datejs/parser.js
http://192.168.1.207:8069/web/static/lib/datejs/sugarpak.js
http://192.168.1.207:8069/web/static/lib/es5-shim
http://192.168.1.207:8069/web/static/lib/es5-shim/es5-shim.min.js
http://192.168.1.207:8069/web/static/lib/fontawesome
http://192.168.1.207:8069/web/static/lib/fontawesome/css
http://192.168.1.207:8069/web/static/lib/fontawesome/css/font-awesome.css
http://192.168.1.207:8069/web/static/lib/fontawesome/fonts
http://192.168.1.207:8069/web/static/lib/jquery
http://192.168.1.207:8069/web/static/lib/jquery.autosize
http://192.168.1.207:8069/web/static/lib/jquery.autosize/jquery.autosize.js
http://192.168.1.207:8069/web/static/lib/jquery.ba-bbq
http://192.168.1.207:8069/web/static/lib/jquery.ba-bbq/jquery.ba-bbq.js
http://192.168.1.207:8069/web/static/lib/jquery.blockUI
http://192.168.1.207:8069/web/static/lib/jquery.blockUI/jquery.blockUI.js
http://192.168.1.207:8069/web/static/lib/jquery.form
http://192.168.1.207:8069/web/static/lib/jquery.form/jquery.form.js
http://192.168.1.207:8069/web/static/lib/jquery.hotkeys
http://192.168.1.207:8069/web/static/lib/jquery.hotkeys/jquery.hotkeys.js
http://192.168.1.207:8069/web/static/lib/jquery.placeholder
http://192.168.1.207:8069/web/static/lib/jquery.placeholder/jquery.placeholder.js
http://192.168.1.207:8069/web/static/lib/jquery.scrollTo
http://192.168.1.207:8069/web/static/lib/jquery.scrollTo/jquery.scrollTo-min.js
http://192.168.1.207:8069/web/static/lib/jquery.textext
http://192.168.1.207:8069/web/static/lib/jquery.textext/jquery.textext.css
http://192.168.1.207:8069/web/static/lib/jquery.textext/jquery.textext.js
http://192.168.1.207:8069/web/static/lib/jquery.timeago
http://192.168.1.207:8069/web/static/lib/jquery.timeago/jquery.timeago.js
http://192.168.1.207:8069/web/static/lib/jquery.ui
http://192.168.1.207:8069/web/static/lib/jquery.ui.bootstrap
http://192.168.1.207:8069/web/static/lib/jquery.ui.bootstrap/css
http://192.168.1.207:8069/web/static/lib/jquery.ui.bootstrap/css/custom-theme
http://192.168.1.207:8069/web/static/lib/jquery.ui.bootstrap/css/custom-theme/images
http://192.168.1.207:8069/web/static/lib/jquery.ui.bootstrap/css/custom-theme/jquery-ui-1.9.0.custom.css
http://192.168.1.207:8069/web/static/lib/jquery.ui.notify
http://192.168.1.207:8069/web/static/lib/jquery.ui.notify/css
http://192.168.1.207:8069/web/static/lib/jquery.ui.notify/css/ui.notify.css
http://192.168.1.207:8069/web/static/lib/jquery.ui.notify/js
http://192.168.1.207:8069/web/static/lib/jquery.ui.notify/js/jquery.notify.js
http://192.168.1.207:8069/web/static/lib/jquery.ui.timepicker
http://192.168.1.207:8069/web/static/lib/jquery.ui.timepicker/css
http://192.168.1.207:8069/web/static/lib/jquery.ui.timepicker/css/jquery-ui-timepicker-addon.css
http://192.168.1.207:8069/web/static/lib/jquery.ui.timepicker/js
http://192.168.1.207:8069/web/static/lib/jquery.ui.timepicker/js/jquery-ui-timepicker-addon.js
http://192.168.1.207:8069/web/static/lib/jquery.ui/css
http://192.168.1.207:8069/web/static/lib/jquery.ui/css/smoothness
http://192.168.1.207:8069/web/static/lib/jquery.ui/css/smoothness/images
http://192.168.1.207:8069/web/static/lib/jquery.ui/js
http://192.168.1.207:8069/web/static/lib/jquery.ui/js/jquery-ui-1.9.1.custom.js
http://192.168.1.207:8069/web/static/lib/jquery.validate
http://192.168.1.207:8069/web/static/lib/jquery.validate/jquery.validate.js
http://192.168.1.207:8069/web/static/lib/jquery/jquery.js
http://192.168.1.207:8069/web/static/lib/py.js
http://192.168.1.207:8069/web/static/lib/py.js/lib
http://192.168.1.207:8069/web/static/lib/py.js/lib/py.js
http://192.168.1.207:8069/web/static/lib/qweb
http://192.168.1.207:8069/web/static/lib/qweb/qweb2.js
http://192.168.1.207:8069/web/static/lib/select2
http://192.168.1.207:8069/web/static/lib/select2/select2.css
http://192.168.1.207:8069/web/static/lib/select2/select2.js
http://192.168.1.207:8069/web/static/lib/spinjs
http://192.168.1.207:8069/web/static/lib/spinjs/spin.js
http://192.168.1.207:8069/web/static/lib/underscore
http://192.168.1.207:8069/web/static/lib/underscore.string
http://192.168.1.207:8069/web/static/lib/underscore.string/lib
http://192.168.1.207:8069/web/static/lib/underscore.string/lib/underscore.string.js
http://192.168.1.207:8069/web/static/lib/underscore/underscore.js
http://192.168.1.207:8069/web/static/src
http://192.168.1.207:8069/web/static/src/css
http://192.168.1.207:8069/web/static/src/css/base.css
http://192.168.1.207:8069/web/static/src/css/data_export.css
http://192.168.1.207:8069/web/static/src/css/full.css
http://192.168.1.207:8069/web/static/src/font
http://192.168.1.207:8069/web/static/src/img
http://192.168.1.207:8069/web/static/src/js
http://192.168.1.207:8069/web/static/src/js/boot.js
http://192.168.1.207:8069/web/static/src/js/chrome.js
http://192.168.1.207:8069/web/static/src/js/core.js
http://192.168.1.207:8069/web/static/src/js/data.js
http://192.168.1.207:8069/web/static/src/js/data_export.js
http://192.168.1.207:8069/web/static/src/js/formats.js
http://192.168.1.207:8069/web/static/src/js/openerpframework.js
http://192.168.1.207:8069/web/static/src/js/pyeval.js
http://192.168.1.207:8069/web/static/src/js/search.js
http://192.168.1.207:8069/web/static/src/js/testing.js
http://192.168.1.207:8069/web/static/src/js/tour.js
http://192.168.1.207:8069/web/static/src/js/view_form.js
http://192.168.1.207:8069/web/static/src/js/view_list.js
http://192.168.1.207:8069/web/static/src/js/view_list_editable.js
http://192.168.1.207:8069/web/static/src/js/view_tree.js
http://192.168.1.207:8069/web/static/src/js/views.js
http://192.168.1.207:8069/web/webclient
http://192.168.1.207:8069/web/webclient/bootstrap_translations

International Standard - ISO 27001:2013: Compliance Report

Uploaded by

Copyright:

Available Formats

International Standard - ISO 27001:2013: Compliance Report

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

International Standard - ISO 27001:2013: Compliance Report

Uploaded by

Copyright:

Available Formats

International Standard - ISO

- Access to networks and network services(9.1.2)

- Management of privileged access rights(9.2.3)

- Management of secret authentication information of users(9.2.4)

- Use of secret authentication information(9.3.1)

- Information access restriction(9.4.1)

- Secure log-on procedures(9.4.2)

- Password management system(9.4.3)

- Use of privileged utility programs(9.4.4)

- Access control to program source code(9.4.5)

- Separation of development, testing and operational environments(12.1.4)

- Protection of log information(12.4.2)

- Administrator and operator logs(12.4.3)

- Installation of software on operational systems(12.5.1)

- Security of network services(13.1.1)

- Information transfer policies and procedures(13.2.1)

- Securing application services on public networks(14.1.2)

- Protecting application services transactions(14.1.3)

- Secure development policy(14.2.1)

- Protection of test data(14.3.1)

- Availability of information processing facilities(17.2.1)

- Privacy and protection of personally identifiable information(18.1.4)

- Regulation of cryptographic controls(18.1.5)

No alerts in this category.

Total number of alerts in this category: 1

Alerts in this category

Session token in URL

Base Score: 0.0

(9.1.2)Access to networks and network services

(9.2.3)Management of privileged access rights

Total number of alerts in this category: 2

Alerts in this category

HTM L form without CSRF protection

This alert requires manual confirmation

Base Score: 2.6

Login page password-guessing attack

(9.2.4)Management of secret authentication information of users

No alerts in this category.

(9.3.1)Use of secret authentication information

Total number of alerts in this category: 1

Alerts in this category

Login page password-guessing attack

Base Score: 5.0

(9.4.1)Information access restriction

Total number of alerts in this category: 1

Alerts in this category

Session token in URL

Base Score: 0.0

(9.4.2)Secure log-on procedures

No alerts in this category.

(9.4.3)Password management system

Total number of alerts in this category: 1

Alerts in this category

Login page password-guessing attack

Base Score: 5.0

No alerts in this category.

(9.4.5)Access control to program source code

Access to program source code shall be restricted.

No alerts in this category.