QID 570079

QID 570079: Minimum and Maximum not Defined for Integer Parameter

Schemas of components contain the definition of various parameters. The parameters can be of various types. Parameter definition of type integer should have limits set so there is clarity on the minimum and maximum values. An analysis of swagger file has resulted in determining that the parameter of integer type does not have limits defined. .

Swagger file is not compliant to swagger specification. Compliance check will result in an error. The current definition of integer parameter does not provide clarity to API consumer and allow of attackers to abuse the API. There is a a potential for resource exhaustion attacks.

CVSS V3 rated as Low - 0 severity.

CVSS V2 rated as Low - 0 severity.

Solution

Integers should be limited to mitigate resource exhaustion attacks. Ensure that minimum and maximum have been defined. Please review swagger file and update your parameters of integer type. In order to avoid unexpected values being sent or API abused, ensure that minimum and maximum have been specified. For example:

openapi: "3.0" components: schemas: UserID: type: integer minimum: 1 maximum: 99

Vendor References

CVEs related to QID 570079

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].