10. of Denial of Service
An attacker can make a server unavailable or unusable without ever authenticating, and the problem persists after the attacker goes away (server, anonymous, persistent).
|
Threat |
|
|
|
You have a file upload endpoint that doesn’t limit the file size, so an attacker sends enough data to fill the storage on the server and stop it from being able to further process requests. |
|
CAPEC |
CAPEC-231 – Oversized serialized data payloads CAPEC-572 – artificially inflate file sizes |
|
ASVS |
5.2.2 – Ensure data is sanitized |
|
CWE |
CWE-400 – Uncontrolled resource consumption |
|
Mitigations |
|
| ... | |
