Continuous Security Testing with CVSS Vulnerability Scoring
173
155
18
26.1 min
|
Category
â–¼
|
Test Name
â–¼
|
Parameters
â–¼
|
Status
â–¼
|
CVSS Score (Baseline)
â–¼
|
Severity
â–¼
|
Duration
â–¼
|
|---|---|---|---|---|---|---|
| Access Control | Users cannot edit the admin account password |
nonAdminType: clerk |
PASS | 8.6 | HIGH | 0.25s |
| Access Control | Users cannot edit the admin account password |
nonAdminType: technician |
PASS | 8.6 | HIGH | 0.04s |
| Access Control | Users cannot edit the admin account password |
nonAdminType: nurse |
PASS | 8.6 | HIGH | 0.04s |
| Access Control | Users cannot edit the admin account password |
nonAdminType: doctor |
PASS | 8.6 | HIGH | 0.04s |
| Access Control | Users can edit their own passwords |
nonAdminType: clerk |
PASS | 7.7 | HIGH | 0.1s |
| Access Control | Users can edit their own passwords |
nonAdminType: technician |
PASS | 7.7 | HIGH | 0.05s |
| Access Control | Users can edit their own passwords |
nonAdminType: nurse |
PASS | 7.7 | HIGH | 0.05s |
| Access Control | Users can edit their own passwords |
nonAdminType: doctor |
PASS | 7.7 | HIGH | 0.05s |
| Authentication | Brute force attack on login page causes lockout |
username: admin password: Admin123 cleanup_clear_user_lockout: doctor |
PASS | 9.2 | CRITICAL | 20.41s |
| Authentication | Brute force attack on login page causes lockout |
username: doctor password: Doctor123 cleanup_clear_user_lockout: doctor |
PASS | 9.2 | CRITICAL | 19.9s |
| Authentication | Brute force attack on login page causes lockout |
username: nurse password: Nurse123 cleanup_clear_user_lockout: doctor |
PASS | 9.2 | CRITICAL | 19.86s |
| Authentication | Brute force attack on login page causes lockout |
username: clerk password: Clerk123 cleanup_clear_user_lockout: doctor |
PASS | 9.2 | CRITICAL | 19.88s |
| Authentication | Brute force attack on login page causes lockout |
username: technician password: Technician123 cleanup_clear_user_lockout: doctor |
PASS | 9.2 | CRITICAL | 19.86s |
| Authentication | Brute force attack on REST API causes lockout |
username: admin password: Admin123 |
PASS | 9.2 | CRITICAL | 0.09s |
| Authentication | Brute force attack on REST API causes lockout |
username: doctor password: Doctor123 |
PASS | 9.2 | CRITICAL | 0.11s |
| Authentication | Brute force attack on REST API causes lockout |
username: nurse password: Nurse123 |
PASS | 9.2 | CRITICAL | 0.1s |
| Authentication | Brute force attack on REST API causes lockout |
username: clerk password: Clerk123 |
PASS | 9.2 | CRITICAL | 0.09s |
| Authentication | Brute force attack on REST API causes lockout |
username: technician password: Technician123 |
PASS | 9.2 | CRITICAL | 0.12s |
| Authentication | Brute force password attack via REST API with known admin username |
cleanup_clear_user_lockout: admin |
PASS | 10.0 | CRITICAL | 0.07s |
| Authentication | Brute force password attack with known admin username |
cleanup_clear_user_lockout: admin |
PASS | 10.0 | CRITICAL | 21.82s |
| Authentication | Correct credentials allows login on REST API |
username: admin password: Admin123 |
PASS | 9.0 | CRITICAL | 0.02s |
| Authentication | Correct credentials allows login on REST API |
username: doctor password: Doctor123 |
PASS | 9.0 | CRITICAL | 0.03s |
| Authentication | Correct credentials allows login on REST API |
username: nurse password: Nurse123 |
PASS | 9.0 | CRITICAL | 0.03s |
| Authentication | Correct credentials allows login on REST API |
username: clerk password: Clerk123 |
PASS | 9.0 | CRITICAL | 0.02s |
| Authentication | Correct credentials allows login on REST API |
username: technician password: Technician123 |
PASS | 9.0 | CRITICAL | 0.02s |
| Authentication | Correct credentials allows login on login page |
username: admin password: Admin123 |
PASS | 9.0 | CRITICAL | 3.68s |
| Authentication | Correct credentials allows login on login page |
username: doctor password: Doctor123 |
PASS | 9.0 | CRITICAL | 3.66s |
| Authentication | Correct credentials allows login on login page |
username: nurse password: Nurse123 |
PASS | 9.0 | CRITICAL | 3.7s |
| Authentication | Correct credentials allows login on login page |
username: clerk password: Clerk123 |
PASS | 9.0 | CRITICAL | 3.65s |
| Authentication | Correct credentials allows login on login page |
username: technician password: Technician123 |
PASS | 9.0 | CRITICAL | 3.65s |
| Authentication | Lockout on login page is accessible after 5 minutes |
username: admin password: Admin123 |
PASS | 9.0 | CRITICAL | 22.0s |
| Authentication | Lockout on login page is accessible after 5 minutes |
username: doctor password: Doctor123 |
PASS | 9.0 | CRITICAL | 22.0s |
| Authentication | Lockout on login page is accessible after 5 minutes |
username: nurse password: Nurse123 |
PASS | 9.0 | CRITICAL | 21.99s |
| Authentication | Lockout on login page is accessible after 5 minutes |
username: clerk password: Clerk123 |
PASS | 9.0 | CRITICAL | 21.99s |
| Authentication | Lockout on login page is accessible after 5 minutes |
username: technician password: Technician123 |
PASS | 9.0 | CRITICAL | 22.01s |
| Authentication | Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: admin password: Admin123 |
PASS | 9.2 | CRITICAL | 23.93s |
| Authentication | Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: doctor password: Doctor123 |
PASS | 9.2 | CRITICAL | 23.93s |
| Authentication | Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: nurse password: Nurse123 |
PASS | 9.2 | CRITICAL | 23.93s |
| Authentication | Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: clerk password: Clerk123 |
PASS | 9.2 | CRITICAL | 23.95s |
| Authentication | Lockout on login page is not accessible at 4 minutes and 50 seconds |
username: technician password: Technician123 |
PASS | 9.2 | CRITICAL | 23.95s |
| Authentication | Lockout on REST API is accessible after 5 minutes |
username: admin password: Admin123 |
PASS | 9.0 | CRITICAL | 0.09s |
| Authentication | Lockout on REST API is accessible after 5 minutes |
username: doctor password: Doctor123 |
PASS | 9.0 | CRITICAL | 0.08s |
| Authentication | Lockout on REST API is accessible after 5 minutes |
username: nurse password: Nurse123 |
PASS | 9.0 | CRITICAL | 0.09s |
| Authentication | Lockout on REST API is accessible after 5 minutes |
username: clerk password: Clerk123 |
PASS | 9.0 | CRITICAL | 0.08s |
| Authentication | Lockout on REST API is accessible after 5 minutes |
username: technician password: Technician123 |
PASS | 9.0 | CRITICAL | 0.08s |
| Authentication | Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: admin password: Admin123 |
PASS | 9.2 | CRITICAL | 0.08s |
| Authentication | Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: doctor password: Doctor123 |
PASS | 9.2 | CRITICAL | 0.13s |
| Authentication | Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: nurse password: Nurse123 |
PASS | 9.2 | CRITICAL | 0.09s |
| Authentication | Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: clerk password: Clerk123 |
PASS | 9.2 | CRITICAL | 0.09s |
| Authentication | Lockout on REST API is not accessible at 4 minutes and 50 seconds |
username: technician password: Technician123 |
PASS | 9.2 | CRITICAL | 0.11s |
| Cryptographic Failures | The OpenMRS application should not use the default encryption key |
N/A |
PASS | 10.0 | CRITICAL | 0.02s |
| Cryptographic Failures | The OpenMRS application should not use the default encryption vector |
N/A |
PASS | 10.0 | CRITICAL | 0.01s |
| Data Integrity Failures | Replace session cookies with another's session |
browser_name: chromium |
FAIL |
8.6
Recorded Errors expect(page.get_by_text("Super User"), message="Another account, other than Admin, was logged in to").to_have_count(1) AssertionError: Another account, other than Admin, was logged in to Expected value: '1' Actual value: 0 Call log: - Expect "to_have_count" with timeout 5000ms - waiting for get_by_text("Super User") 9 × locator resolved to 0 elements - unexpected value "0" |
HIGH | 10.93s |
| Insecure Design | Appointments should be blocked after reaching max load |
browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: General Medicine service |
FAIL |
6.4
Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2 |
MEDIUM | 42.23s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: Antenatal care |
PASS | 10.0 | CRITICAL | 21.91s |
| SQL Injection | SQL injection on first name field of edit patient page |
browser_name: chromium personNameSQLString: first name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY); |
PASS | 9.2 | CRITICAL | 22.07s |
| XSS | Valid input for first name field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: first name |
PASS | 8.6 | HIGH | 8.5s |
| XSS | XSS injection on first name field of edit patient page, parameterized |
browser_name: chromium scenarioString: first name testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.63s |
| Insecure Design | Appointments should be blocked after reaching max load |
browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: Outpatient Department |
FAIL |
6.4
Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2 |
MEDIUM | 36.32s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: Orthopedic Service |
PASS | 10.0 | CRITICAL | 20.9s |
| SQL Injection | SQL injection on middle name field of edit patient page |
browser_name: chromium personNameSQLString: middle name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY); |
PASS | 9.2 | CRITICAL | 14.69s |
| XSS | Valid input for middle name field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: middle name |
PASS | 8.6 | HIGH | 8.88s |
| XSS | XSS injection on first name field of edit patient page, parameterized |
browser_name: chromium scenarioString: first name testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.66s |
| Insecure Design | Appointments should be blocked after reaching max load |
browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: Rehabilitation service |
FAIL |
6.4
Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2 |
MEDIUM | 35.97s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: Nutrition counseling |
PASS | 10.0 | CRITICAL | 20.89s |
| SQL Injection | SQL injection on family name field of edit patient page |
browser_name: chromium personNameSQLString: family name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY); |
PASS | 9.2 | CRITICAL | 14.77s |
| XSS | Valid input for family name field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: family name |
PASS | 8.6 | HIGH | 8.44s |
| XSS | XSS injection on first name field of edit patient page, parameterized |
browser_name: chromium scenarioString: first name testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.68s |
| Insecure Design | Appointments should be blocked after reaching max load |
browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: General Medicine service |
PASS | 6.4 | MEDIUM | 25.05s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1 billing_category: OPD consultation |
PASS | 10.0 | CRITICAL | 20.86s |
| XSS | Valid input for address 1 field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: address 1 |
PASS | 8.6 | HIGH | 8.52s |
| XSS | XSS injection on middle name field of edit patient page, parameterized |
browser_name: chromium scenarioString: middle name testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.6s |
| Insecure Design | Appointments should be blocked after reaching max load |
browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: Outpatient Department |
PASS | 6.4 | MEDIUM | 25.0s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: Antenatal care |
PASS | 10.0 | CRITICAL | 20.88s |
| XSS | Valid input for address 2 field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: address 2 |
PASS | 8.6 | HIGH | 8.42s |
| XSS | XSS injection on middle name field of edit patient page, parameterized |
browser_name: chromium scenarioString: middle name testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.58s |
| Insecure Design | Appointments should be blocked after reaching max load |
browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: Rehabilitation service |
PASS | 6.4 | MEDIUM | 24.84s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: Orthopedic Service |
PASS | 10.0 | CRITICAL | 20.88s |
| XSS | Valid input for city field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: city |
PASS | 8.6 | HIGH | 8.43s |
| XSS | XSS injection on middle name field of edit patient page, parameterized |
browser_name: chromium scenarioString: middle name testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.69s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: Nutrition counseling |
PASS | 10.0 | CRITICAL | 20.93s |
| XSS | Valid input for state field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: state |
PASS | 8.6 | HIGH | 8.4s |
| XSS | XSS injection on family name field of edit patient page, parameterized |
browser_name: chromium scenarioString: family name testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 11.07s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 1000000 billing_category: OPD consultation |
PASS | 10.0 | CRITICAL | 20.87s |
| XSS | Valid input for country field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: country |
PASS | 8.6 | HIGH | 8.38s |
| XSS | XSS injection on family name field of edit patient page, parameterized |
browser_name: chromium scenarioString: family name testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.59s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: Antenatal care |
PASS | 10.0 | CRITICAL | 20.87s |
| XSS | Valid input for postal code field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: postal code |
PASS | 8.6 | HIGH | 8.45s |
| XSS | XSS injection on family name field of edit patient page, parameterized |
browser_name: chromium scenarioString: family name testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.6s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: Orthopedic Service |
PASS | 10.0 | CRITICAL | 20.9s |
| XSS | Valid input for phone number field of edit patient page is not blocked by filters |
browser_name: chromium scenarioString: phone number |
PASS | 8.6 | HIGH | 8.83s |
| XSS | XSS injection on address 1 field of edit patient page, parameterized |
browser_name: chromium scenarioString: address 1 testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.63s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: Nutrition counseling |
PASS | 10.0 | CRITICAL | 20.89s |
| XSS | XSS injection on address 1 field of edit patient page, parameterized |
browser_name: chromium scenarioString: address 1 testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.64s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483647 billing_category: OPD consultation |
PASS | 10.0 | CRITICAL | 20.9s |
| XSS | XSS injection on address 1 field of edit patient page, parameterized |
browser_name: chromium scenarioString: address 1 testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.61s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: Antenatal care |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 20.9s |
| XSS | XSS injection on address 2 field of edit patient page, parameterized |
browser_name: chromium scenarioString: address 2 testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.61s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: Orthopedic Service |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 20.92s |
| XSS | XSS injection on address 2 field of edit patient page, parameterized |
browser_name: chromium scenarioString: address 2 testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.61s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: Nutrition counseling |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 20.88s |
| XSS | XSS injection on address 2 field of edit patient page, parameterized |
browser_name: chromium scenarioString: address 2 testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.65s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 2147483648 billing_category: OPD consultation |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648 |
CRITICAL | 20.93s |
| XSS | XSS injection on city field of edit patient page, parameterized |
browser_name: chromium scenarioString: city testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.63s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: Antenatal care |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 20.85s |
| XSS | XSS injection on city field of edit patient page, parameterized |
browser_name: chromium scenarioString: city testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.59s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: Orthopedic Service |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 20.88s |
| XSS | XSS injection on city field of edit patient page, parameterized |
browser_name: chromium scenarioString: city testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.61s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: Nutrition counseling |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 20.88s |
| XSS | XSS injection on state field of edit patient page, parameterized |
browser_name: chromium scenarioString: state testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.61s |
| Memory Management Failures | Integer overflow of quantity on billing page |
browser_name: chromium quantity: 4294967294 billing_category: OPD consultation |
FAIL |
10.0
Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294 |
CRITICAL | 20.85s |
| XSS | XSS injection on state field of edit patient page, parameterized |
browser_name: chromium scenarioString: state testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.67s |
| Mishandling of Exceptional Conditions | Web server version name and number should not be shown on 404 page |
N/A |
FAIL |
6.4
Recorded Errors assert page_data["is_text_on_page"] == False assert True == False |
MEDIUM | 1.09s |
| Security Logging & Alerting Failures | Server logs should not show failed login attempts with correct credentials |
username: admin password: Admin123 |
PASS | 6.4 | MEDIUM | 8.67s |
| Security Logging & Alerting Failures | Server logs should not show failed login attempts with correct credentials |
username: doctor password: Doctor123 |
PASS | 6.4 | MEDIUM | 8.96s |
| Security Logging & Alerting Failures | Server logs should not show failed login attempts with correct credentials |
username: nurse password: Nurse123 |
PASS | 6.4 | MEDIUM | 8.94s |
| Security Logging & Alerting Failures | Server logs should not show failed login attempts with correct credentials |
username: clerk password: Clerk123 |
PASS | 6.4 | MEDIUM | 8.97s |
| Security Logging & Alerting Failures | Server logs should not show failed login attempts with correct credentials |
username: technician password: Technician123 |
PASS | 6.4 | MEDIUM | 8.96s |
| Security Logging & Alerting Failures | Server logs should show failed login attempts |
username: admin |
PASS | 6.4 | MEDIUM | 5.94s |
| Security Logging & Alerting Failures | Server logs should show failed login attempts |
username: doctor |
PASS | 6.4 | MEDIUM | 5.92s |
| Security Logging & Alerting Failures | Server logs should show failed login attempts |
username: nurse |
PASS | 6.4 | MEDIUM | 5.93s |
| Security Logging & Alerting Failures | Server logs should show failed login attempts |
username: clerk |
PASS | 6.4 | MEDIUM | 5.86s |
| Security Logging & Alerting Failures | Server logs should show failed login attempts |
username: technician |
PASS | 6.4 | MEDIUM | 5.94s |
| Security Logging & Alerting Failures | Server logs should show failed login attempts |
username: fakeusername1 |
PASS | 6.4 | MEDIUM | 5.92s |
| Security Logging & Alerting Failures | Server logs should show failed login attempts |
username: fakeusername2 |
PASS | 6.4 | MEDIUM | 5.95s |
| Security Misconfiguration | Security header attribute 'unsafe-eval' should not be used for default-src directive on login page |
attribute: 'unsafe-eval' |
FAIL |
8.2
Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-eval'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*'] |
HIGH | 0.27s |
| Security Misconfiguration | Security header attribute 'unsafe-inline' should not be used for default-src directive on login page |
attribute: 'unsafe-inline' |
FAIL |
8.2
Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-inline'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*'] |
HIGH | 0.27s |
| Security Misconfiguration | Security header attribute 'unsafe-hash' should not be used for default-src directive on login page |
attribute: 'unsafe-hash' |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive default-src should be set to 'none' or 'self' on login page |
directive: default-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive script-src should be set to 'none' or 'self' on login page |
directive: script-src fallback: True |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header directive style-src should be set to 'none' or 'self' on login page |
directive: style-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive connect-src should be set to 'none' or 'self' on login page |
directive: connect-src fallback: True |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header directive media-src should be set to 'none' or 'self' on login page |
directive: media-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive object-src should be set to 'none' or 'self' on login page |
directive: object-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive frame-src should be set to 'none' or 'self' on login page |
directive: frame-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive worker-src should be set to 'none' or 'self' on login page |
directive: worker-src fallback: True |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header directive manifest-src should be set to 'none' or 'self' on login page |
directive: manifest-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive child-src should be set to 'none' or 'self' on login page |
directive: child-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive font-src should be set to 'none' or 'self' on login page |
directive: font-src fallback: True |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header directive frame-ancestors should be set to 'none' or 'self' on login page |
directive: frame-ancestors fallback: False |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive form-action should be set to 'none' or 'self' on login page |
directive: form-action fallback: False |
FAIL |
8.2
Recorded Errors assert is_directive_secure == True assert False == True |
HIGH | 0.26s |
| Security Misconfiguration | Security header directive base-uri should be set to 'none' or 'self' on login page |
directive: base-uri fallback: False |
PASS | 8.2 | HIGH | 0.28s |
| Security Misconfiguration | Security header directive default-src should not be set to * or http: on login page |
directive: default-src fallback: True |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header directive script-src should not be set to * or http: on login page |
directive: script-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive style-src should not be set to * or http: on login page |
directive: style-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive connect-src should not be set to * or http: on login page |
directive: connect-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive media-src should not be set to * or http: on login page |
directive: media-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive object-src should not be set to * or http: on login page |
directive: object-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive frame-src should not be set to * or http: on login page |
directive: frame-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive worker-src should not be set to * or http: on login page |
directive: worker-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive manifest-src should not be set to * or http: on login page |
directive: manifest-src fallback: True |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header directive child-src should not be set to * or http: on login page |
directive: child-src fallback: True |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header directive font-src should not be set to * or http: on login page |
directive: font-src fallback: True |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive frame-ancestors should not be set to * or http: on login page |
directive: frame-ancestors fallback: False |
PASS | 8.2 | HIGH | 0.26s |
| Security Misconfiguration | Security header directive form-action should not be set to * or http: on login page |
directive: form-action fallback: False |
FAIL |
8.2
Recorded Errors assert is_directive_secure == True assert False == True |
HIGH | 0.27s |
| Security Misconfiguration | Security header directive base-uri should not be set to * or http: on login page |
directive: base-uri fallback: False |
PASS | 8.2 | HIGH | 0.27s |
| Security Misconfiguration | Security header x-content-type-options is set to nosniff on login page |
N/A |
PASS | 4.8 | MEDIUM | 0.27s |
| Session Management | Session cookie should change when logging out |
N/A |
PASS | 9.2 | CRITICAL | 4.73s |
| Session Management | Cookies have HTTPOnly attribute |
N/A |
PASS | 9.2 | CRITICAL | 2.5s |
| Session Management | Session cookie hijacked |
N/A |
PASS | 9.2 | CRITICAL | 4.78s |
| Session Management | Cookies have SameSite attribute |
N/A |
PASS | 5.1 | MEDIUM | 2.51s |
| Session Management | Cookies have Secure attribute |
N/A |
FAIL |
9.2
Recorded Errors assert cookie["secure"] == True assert False == True |
CRITICAL | 2.5s |
| Session Management | Session cookie can be used by a valid user |
N/A |
PASS | 9.2 | CRITICAL | 3.09s |
| XSS | XSS injection on state field of edit patient page, parameterized |
browser_name: chromium scenarioString: state testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.57s |
| XSS | XSS injection on country field of edit patient page, parameterized |
browser_name: chromium scenarioString: country testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.59s |
| XSS | XSS injection on country field of edit patient page, parameterized |
browser_name: chromium scenarioString: country testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.6s |
| XSS | XSS injection on country field of edit patient page, parameterized |
browser_name: chromium scenarioString: country testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.56s |
| XSS | XSS injection on postal code field of edit patient page, parameterized |
browser_name: chromium scenarioString: postal code testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 11.01s |
| XSS | XSS injection on postal code field of edit patient page, parameterized |
browser_name: chromium scenarioString: postal code testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.54s |
| XSS | XSS injection on postal code field of edit patient page, parameterized |
browser_name: chromium scenarioString: postal code testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 10.57s |
| XSS | XSS injection on phone number field of edit patient page, parameterized |
browser_name: chromium scenarioString: phone number testString: <img src/onerror=prompt('XSS') |
PASS | 4.4 | MEDIUM | 10.62s |
| XSS | XSS injection on phone number field of edit patient page, parameterized |
browser_name: chromium scenarioString: phone number testString: <img src=x onerror=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 11.08s |
| XSS | XSS injection on phone number field of edit patient page, parameterized |
browser_name: chromium scenarioString: phone number testString: <svg onload=prompt("XSS")> |
PASS | 4.4 | MEDIUM | 11.14s |