QID 570078

QID 570078: Limits not Defined for Integer Parameter

Schemas of components contain the definition of various parameters. The parameters can be of various types. Parameter definition of type integer should have limits set so there is clarity on the minimum and maximum values. An analysis of swagger file has resulted in determining that the parameter of integer type does not have limits defined.

Swagger file is not compliant to swagger specification. Compliance check will result in an error. The current definition of integer parameter does not provide clarity to API consumer and allow of attackers to abuse the API. There is a a potential for resource exhaustion attacks.

CVSS V3 rated as Low - 0 severity.

CVSS V2 rated as Low - 0 severity.

Solution

Please review swagger file and update your parameters of integer type. In order to avoid unexpected values being sent or API abused, ensure that minimum and maximum or exclusiveMinimum and exclusiveMaximum have been specified. Any combination of the following fields can be enforced on your integer parameters to address this error:

minimum and maximum
exclusiveMinimum and exclusiveMaximum
or used in a combination between above

For example:

openapi: "3.0" components: schemas: UserID: type: integer exclusiveMinimum: 1 maximum: 99

Vendor References

CVEs related to QID 570078

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].