QID 570080

QID 570080: Format not Defined for Integer Parameter

Schema of type integer must specify format of int32 or int64.

Swagger file is not compliant to swagger specification. Compliance check will result in an error. The current definition of integer parameter does not provide clarity to API consumer and allow of attackers to abuse the API. There is a a potential for resource exhaustion attacks.

CVSS V3 rated as Low - 0 severity.

CVSS V2 rated as Low - 0 severity.

Solution

Please review swagger file and update your parameters of integer type. In order to avoid unexpected values being sent or API abused, ensure that format of either int32 or int64 is specified for integer parameters. For example:

openapi: "3.1.0" components: schemas: userId: type: integer format: int64

Vendor References

CVEs related to QID 570080

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].