Continuous Security Testing with CVSS Vulnerability Scoring
173
155
18
32.6 min
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Users cannot edit the admin account password |
_pytest_bdd_example: {'nonAdminType': 'clerk'} |
Non Admin users should not be able to edit the password of the admin account by posting to the API. | PASS | 8.6 | HIGH | 0.28s |
| Users cannot edit the admin account password |
_pytest_bdd_example: {'nonAdminType': 'technician'} |
Non Admin users should not be able to edit the password of the admin account by posting to the API. | PASS | 8.6 | HIGH | 0.06s |
| Users cannot edit the admin account password |
_pytest_bdd_example: {'nonAdminType': 'nurse'} |
Non Admin users should not be able to edit the password of the admin account by posting to the API. | PASS | 8.6 | HIGH | 0.05s |
| Users cannot edit the admin account password |
_pytest_bdd_example: {'nonAdminType': 'doctor'} |
Non Admin users should not be able to edit the password of the admin account by posting to the API. | PASS | 8.6 | HIGH | 0.04s |
| Users can edit their own passwords |
_pytest_bdd_example: {'nonAdminType': 'clerk'} |
Non Admin users should be able to edit their passwords | PASS | 7.7 | HIGH | 0.11s |
| Users can edit their own passwords |
_pytest_bdd_example: {'nonAdminType': 'technician'} |
Non Admin users should be able to edit their passwords | PASS | 7.7 | HIGH | 0.09s |
| Users can edit their own passwords |
_pytest_bdd_example: {'nonAdminType': 'nurse'} |
Non Admin users should be able to edit their passwords | PASS | 7.7 | HIGH | 0.09s |
| Users can edit their own passwords |
_pytest_bdd_example: {'nonAdminType': 'doctor'} |
Non Admin users should be able to edit their passwords | PASS | 7.7 | HIGH | 0.09s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Brute force attack on login page causes lockout |
username: admin password: Admin123 cleanup_clear_user_lockout: doctor |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 21.24s |
| Brute force attack on login page causes lockout |
username: doctor password: Doctor123 cleanup_clear_user_lockout: doctor |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 20.22s |
| Brute force attack on login page causes lockout |
username: nurse password: Nurse123 cleanup_clear_user_lockout: doctor |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 20.18s |
| Brute force attack on login page causes lockout |
username: clerk password: Clerk123 cleanup_clear_user_lockout: doctor |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 20.26s |
| Brute force attack on login page causes lockout |
username: technician password: Technician123 cleanup_clear_user_lockout: doctor |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 20.22s |
| Brute force attack on REST API causes lockout |
username: admin password: Admin123 |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 0.08s |
| Brute force attack on REST API causes lockout |
username: doctor password: Doctor123 |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 0.1s |
| Brute force attack on REST API causes lockout |
username: nurse password: Nurse123 |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 0.09s |
| Brute force attack on REST API causes lockout |
username: clerk password: Clerk123 |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 0.09s |
| Brute force attack on REST API causes lockout |
username: technician password: Technician123 |
Tests whether the system will lockout an attacker from a brute force attack. | PASS | 9.2 | CRITICAL | 0.11s |
| Brute force password attack via REST API with known admin username |
cleanup_clear_user_lockout: admin |
Tests whether an attacker can login accross the API using a known username and random passwords. | PASS | 10.0 | CRITICAL | 0.1s |
| Brute force password attack with known admin username |
cleanup_clear_user_lockout: admin |
Tests whether an attacker can login to the login page using a known username and random passwords. | PASS | 10.0 | CRITICAL | 22.27s |
| Correct credentials allows login on REST API |
username: admin password: Admin123 |
Tests whether a regular user can log in to the api | PASS | 9.0 | CRITICAL | 0.02s |
| Correct credentials allows login on REST API |
username: doctor password: Doctor123 |
Tests whether a regular user can log in to the api | PASS | 9.0 | CRITICAL | 0.02s |
| Correct credentials allows login on REST API |
username: nurse password: Nurse123 |
Tests whether a regular user can log in to the api | PASS | 9.0 | CRITICAL | 0.02s |
| Correct credentials allows login on REST API |
username: clerk password: Clerk123 |
Tests whether a regular user can log in to the api | PASS | 9.0 | CRITICAL | 0.02s |
| Correct credentials allows login on REST API |
username: technician password: Technician123 |
Tests whether a regular user can log in to the api | PASS | 9.0 | CRITICAL | 0.02s |
| Correct credentials allows login on login page |
username: admin password: Admin123 |
Tests whether a regular user can log in to the webpage | PASS | 9.0 | CRITICAL | 3.97s |
| Correct credentials allows login on login page |
username: doctor password: Doctor123 |
Tests whether a regular user can log in to the webpage | PASS | 9.0 | CRITICAL | 4.13s |
| Correct credentials allows login on login page |
username: nurse password: Nurse123 |
Tests whether a regular user can log in to the webpage | PASS | 9.0 | CRITICAL | 4.07s |
| Correct credentials allows login on login page |
username: clerk password: Clerk123 |
Tests whether a regular user can log in to the webpage | PASS | 9.0 | CRITICAL | 4.17s |
| Correct credentials allows login on login page |
username: technician password: Technician123 |
Tests whether a regular user can log in to the webpage | PASS | 9.0 | CRITICAL | 4.11s |
| Lockout on login page is accessible after 5 minutes |
username: admin password: Admin123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 22.52s |
| Lockout on login page is accessible after 5 minutes |
username: doctor password: Doctor123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 22.51s |
| Lockout on login page is accessible after 5 minutes |
username: nurse password: Nurse123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 22.54s |
| Lockout on login page is accessible after 5 minutes |
username: clerk password: Clerk123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 22.5s |
| Lockout on login page is accessible after 5 minutes |
username: technician password: Technician123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 22.48s |
| Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: admin password: Admin123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 24.3s |
| Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: doctor password: Doctor123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 24.28s |
| Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: nurse password: Nurse123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 24.3s |
| Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: clerk password: Clerk123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 24.34s |
| Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: technician password: Technician123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 24.3s |
| Lockout on REST API is accessible after 5 minutes |
username: admin password: Admin123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 0.1s |
| Lockout on REST API is accessible after 5 minutes |
username: doctor password: Doctor123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 0.1s |
| Lockout on REST API is accessible after 5 minutes |
username: nurse password: Nurse123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 0.1s |
| Lockout on REST API is accessible after 5 minutes |
username: clerk password: Clerk123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 0.09s |
| Lockout on REST API is accessible after 5 minutes |
username: technician password: Technician123 |
Tests whether an account is accessible after a 5 minute waiting period | PASS | 9.0 | CRITICAL | 0.09s |
| Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: admin password: Admin123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 0.09s |
| Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: doctor password: Doctor123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 0.1s |
| Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: nurse password: Nurse123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 0.08s |
| Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: clerk password: Clerk123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 0.09s |
| Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: technician password: Technician123 |
Tests whether an account is accessible after a 4 minute and 50 second waiting period | PASS | 9.2 | CRITICAL | 0.09s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| The OpenMRS application should not use the default encryption key |
N/A |
The current encrpytion key should not match the default key for the system. | PASS | 10.0 | CRITICAL | 0.02s |
| The OpenMRS application should not use the default encryption vector |
N/A |
The current encrpytion vector should not match the default vector for the system. | PASS | 10.0 | CRITICAL | 0.01s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Replace session cookies with another's session |
browser_name: chromium |
If a session token can be replaced with another, a compromised session token at one location could give an attacker unrestricted access at another | FAIL |
8.6
Recorded Errors expect(page.get_by_text("Super User"), message="Another account, other than Admin, was logged in to").to_have_count(1) AssertionError: Another account, other than Admin, was logged in to Expected value: '1' Actual value: 0 Call log: - Expect "to_have_count" with timeout 5000ms - waiting for get_by_text("Super User") 9 × locator resolved to 0 elements - unexpected value "0" |
HIGH | 12.7s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Appointments should be blocked after reaching max load |
browser_name: chromium _pytest_bdd_example: {'numberOfPatients': '2', 'maxAppointments': '2'} service_name: General Medicine service |
An appointment service should not allow a new appointment after going past the max number | PASS | 6.4 | MEDIUM | 25.77s |
| Appointments should be blocked after reaching max load |
browser_name: chromium _pytest_bdd_example: {'numberOfPatients': '2', 'maxAppointments': '2'} service_name: Outpatient Department |
An appointment service should not allow a new appointment after going past the max number | PASS | 6.4 | MEDIUM | 25.77s |
| Appointments should be blocked after reaching max load |
browser_name: chromium _pytest_bdd_example: {'numberOfPatients': '2', 'maxAppointments': '2'} service_name: Rehabilitation service |
An appointment service should not allow a new appointment after going past the max number | PASS | 6.4 | MEDIUM | 25.65s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Appointments should be blocked after reaching max load |
browser_name: chromium _pytest_bdd_example: {'numberOfPatients': '3', 'maxAppointments': '2'} service_name: General Medicine service |
An appointment service should not allow a new appointment after going past the max number | FAIL |
6.4
Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2 |
MEDIUM | 42.91s |
| Appointments should be blocked after reaching max load |
browser_name: chromium _pytest_bdd_example: {'numberOfPatients': '3', 'maxAppointments': '2'} service_name: Outpatient Department |
An appointment service should not allow a new appointment after going past the max number | FAIL |
6.4
Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2 |
MEDIUM | 37.18s |
| Appointments should be blocked after reaching max load |
browser_name: chromium _pytest_bdd_example: {'numberOfPatients': '3', 'maxAppointments': '2'} service_name: Rehabilitation service |
An appointment service should not allow a new appointment after going past the max number | FAIL |
6.4
Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2 |
MEDIUM | 37.07s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: Antenatal care |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 22.58s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: Orthopedic Service |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.5s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: Nutrition counseling |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.54s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: OPD consultation |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.44s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: Antenatal care |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.46s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: Orthopedic Service |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.56s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: Nutrition counseling |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.61s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: OPD consultation |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.47s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: Antenatal care |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.4s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: Orthopedic Service |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.31s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: Nutrition counseling |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.5s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: OPD consultation |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | PASS | 10.0 | CRITICAL | 21.44s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: Antenatal care |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 21.44s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: Orthopedic Service |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 21.43s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: Nutrition counseling |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 21.44s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: OPD consultation |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 21.45s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: Antenatal care |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 21.44s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: Orthopedic Service |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 21.47s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: Nutrition counseling |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 21.34s |
| Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: OPD consultation |
On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound | FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 21.46s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| SQL injection on first name field of edit patient page |
browser_name: chromium _pytest_bdd_example: {'personNameSQLString': 'first name'} testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY); |
A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model. | PASS | 9.2 | CRITICAL | 23.82s |
| SQL injection on middle name field of edit patient page |
browser_name: chromium _pytest_bdd_example: {'personNameSQLString': 'middle name'} testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY); |
A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model. | PASS | 9.2 | CRITICAL | 16.83s |
| SQL injection on family name field of edit patient page |
browser_name: chromium _pytest_bdd_example: {'personNameSQLString': 'family name'} testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY); |
A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model. | PASS | 9.2 | CRITICAL | 17.32s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Valid input for first name field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'first name'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.73s |
| XSS injection on first name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'first name'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.72s |
| Valid input for middle name field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'middle name'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.52s |
| XSS injection on first name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'first name'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.65s |
| Valid input for family name field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'family name'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.53s |
| XSS injection on first name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'first name'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.48s |
| Valid input for address 1 field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 1'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.51s |
| XSS injection on middle name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'middle name'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.45s |
| Valid input for address 2 field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 2'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.56s |
| XSS injection on middle name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'middle name'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.43s |
| Valid input for city field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'city'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.74s |
| XSS injection on middle name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'middle name'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.64s |
| Valid input for state field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'state'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.53s |
| XSS injection on family name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'family name'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.46s |
| Valid input for country field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'country'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 16.43s |
| XSS injection on family name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'family name'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.93s |
| Valid input for postal code field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'postal code'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 17.07s |
| XSS injection on family name field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'family name'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.58s |
| Valid input for phone number field of edit patient page is not blocked by filters |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'phone number'} |
A parameterized test to try valid input on the |
PASS | 8.6 | HIGH | 17.02s |
| XSS injection on address 1 field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 1'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.46s |
| XSS injection on address 1 field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 1'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.57s |
| XSS injection on address 1 field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 1'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.45s |
| XSS injection on address 2 field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 2'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.41s |
| XSS injection on address 2 field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 2'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.8s |
| XSS injection on address 2 field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'address 2'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.49s |
| XSS injection on city field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'city'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.67s |
| XSS injection on city field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'city'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.48s |
| XSS injection on city field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'city'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.59s |
| XSS injection on state field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'state'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.76s |
| XSS injection on state field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'state'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.4s |
| XSS injection on state field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'state'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.49s |
| XSS injection on country field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'country'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.52s |
| XSS injection on country field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'country'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.49s |
| XSS injection on country field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'country'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.87s |
| XSS injection on postal code field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'postal code'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.4s |
| XSS injection on postal code field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'postal code'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.52s |
| XSS injection on postal code field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'postal code'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.73s |
| XSS injection on phone number field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'phone number'} testString: <img src/onerror=prompt('XSS') |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.54s |
| XSS injection on phone number field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'phone number'} testString: <img src=x onerror=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.43s |
| XSS injection on phone number field of edit patient page, parameterized |
browser_name: chromium _pytest_bdd_example: {'scenarioString': 'phone number'} testString: <svg onload=prompt("XSS")> |
A parameterized test to try several potential XSS injection strings on the |
PASS | 4.4 | MEDIUM | 19.58s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Web server version name and number should not be shown on 404 page |
N/A |
Apache Tomcat version number should not be shown when the default HTTP 404 Error page is shown | FAIL |
6.4
Recorded Errors assert page_data["is_text_on_page"] == False assert True == False |
MEDIUM | 1.09s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Server logs should not show failed login attempts with correct credentials |
username: admin password: Admin123 |
A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs | PASS | 6.4 | MEDIUM | 9.07s |
| Server logs should not show failed login attempts with correct credentials |
username: doctor password: Doctor123 |
A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs | PASS | 6.4 | MEDIUM | 9.43s |
| Server logs should not show failed login attempts with correct credentials |
username: nurse password: Nurse123 |
A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs | PASS | 6.4 | MEDIUM | 9.27s |
| Server logs should not show failed login attempts with correct credentials |
username: clerk password: Clerk123 |
A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs | PASS | 6.4 | MEDIUM | 9.25s |
| Server logs should not show failed login attempts with correct credentials |
username: technician password: Technician123 |
A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs | PASS | 6.4 | MEDIUM | 9.32s |
| Server logs should show failed login attempts |
username: admin |
A failed login attempt with an incorrect username or password should be shown in the logs | PASS | 6.4 | MEDIUM | 6.28s |
| Server logs should show failed login attempts |
username: doctor |
A failed login attempt with an incorrect username or password should be shown in the logs | PASS | 6.4 | MEDIUM | 6.3s |
| Server logs should show failed login attempts |
username: nurse |
A failed login attempt with an incorrect username or password should be shown in the logs | PASS | 6.4 | MEDIUM | 6.43s |
| Server logs should show failed login attempts |
username: clerk |
A failed login attempt with an incorrect username or password should be shown in the logs | PASS | 6.4 | MEDIUM | 6.33s |
| Server logs should show failed login attempts |
username: technician |
A failed login attempt with an incorrect username or password should be shown in the logs | PASS | 6.4 | MEDIUM | 6.33s |
| Server logs should show failed login attempts |
username: fakeusername1 |
A failed login attempt with an incorrect username or password should be shown in the logs | PASS | 6.4 | MEDIUM | 6.43s |
| Server logs should show failed login attempts |
username: fakeusername2 |
A failed login attempt with an incorrect username or password should be shown in the logs | PASS | 6.4 | MEDIUM | 6.31s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Security header attribute 'unsafe-hash' should not be used for default-src directive on login page |
_pytest_bdd_example: {'attribute': "'unsafe-hash'"} |
The content-security-policy header should not have unsafe- attributes for the default-src directive | PASS | 8.2 | HIGH | 0.37s |
| Security header directive default-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'default-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive script-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'script-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive style-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'style-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive connect-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'connect-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive media-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'media-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive object-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'object-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive frame-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'frame-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive worker-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'worker-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive manifest-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'manifest-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive child-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'child-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive font-src should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'font-src', 'fallback': 'True'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive frame-ancestors should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'frame-ancestors', 'fallback': 'False'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive base-uri should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'base-uri', 'fallback': 'False'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive default-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'default-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive script-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'script-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive style-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'style-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive connect-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'connect-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive media-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'media-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive object-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'object-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive frame-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'frame-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive worker-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'worker-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive manifest-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'manifest-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive child-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'child-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.38s |
| Security header directive font-src should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'font-src', 'fallback': 'True'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive frame-ancestors should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'frame-ancestors', 'fallback': 'False'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header directive base-uri should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'base-uri', 'fallback': 'False'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | PASS | 8.2 | HIGH | 0.37s |
| Security header x-content-type-options is set to nosniff on login page |
N/A |
Files are run using the content type because nosniff is set for the header x-content-type-options | PASS | 4.8 | MEDIUM | 0.38s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Security header attribute 'unsafe-eval' should not be used for default-src directive on login page |
_pytest_bdd_example: {'attribute': "'unsafe-eval'"} |
The content-security-policy header should not have unsafe- attributes for the default-src directive | FAIL |
8.2
Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-eval'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*'] |
HIGH | 0.38s |
| Security header attribute 'unsafe-inline' should not be used for default-src directive on login page |
_pytest_bdd_example: {'attribute': "'unsafe-inline'"} |
The content-security-policy header should not have unsafe- attributes for the default-src directive | FAIL |
8.2
Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-inline'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*'] |
HIGH | 0.37s |
| Security header directive form-action should be set to 'none' or 'self' on login page |
_pytest_bdd_example: {'directive': 'form-action', 'fallback': 'False'} |
Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src | FAIL |
8.2
Recorded Errors assert is_directive_secure == True assert False == True |
HIGH | 0.37s |
| Security header directive form-action should not be set to * or http: on login page |
_pytest_bdd_example: {'directive': 'form-action', 'fallback': 'False'} |
Directives should not be set to * or http: on login page if it exists and falls back to default-src | FAIL |
8.2
Recorded Errors assert is_directive_secure == True assert False == True |
HIGH | 0.38s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Session cookie should change when logging out |
N/A |
After a user logs out of a system, the cookie holding information about the login should expire and a new one should be created | PASS | 9.2 | CRITICAL | 5.33s |
| Cookies have HTTPOnly attribute |
N/A |
Test whether cookies have the HTTPOnly attribute enabled. | PASS | 9.2 | CRITICAL | 2.81s |
| Session cookie hijacked |
N/A |
After a user logs out of a system, the cookie holding information about the login is used to try and regain access | PASS | 9.2 | CRITICAL | 5.37s |
| Cookies have SameSite attribute |
N/A |
Test whether cookies have the SameSite attribute to Strict or Lax. | PASS | 5.1 | MEDIUM | 2.82s |
| Session cookie can be used by a valid user |
N/A |
After leaving the page and coming back without logging out the cookie information grants access to the users account | PASS | 9.2 | CRITICAL | 3.7s |
| Test Name | Parameters | Description | Status | CVSS Score (Baseline) | Severity | Duration |
|---|---|---|---|---|---|---|
| Cookies have Secure attribute |
N/A |
Test whether cookies have the secure attribute enabled. | FAIL |
9.2
Recorded Errors assert cookie["secure"] == True assert False == True |
CRITICAL | 2.83s |