Issue Details
Security Misconfiguration
api08-2023 • Rank #8 in OWASP 2023
Explanation
API misconfiguration includes insecure defaults, verbose errors, exposed admin consoles, weak TLS setup, permissive CORS, and inconsistent environment hardening. Attackers chain these gaps with other vulnerabilities to move laterally or exfiltrate data. Misconfiguration risk increases when infrastructure and application settings drift across environments.
Remedy
Establish hardened baseline configurations for each environment and enforce them through infrastructure-as-code and CI validation. Disable debug features in production, lock down CORS and headers, and perform recurring config audits. Detect drift continuously and block deployments that violate security baselines.
| Year | Rank | Category |
|---|---|---|
| 2023 | #8 | api08-2023 - Security Misconfiguration |