{"action":"created","issue":{"url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/187","repository_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy","labels_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/187/labels{/name}","comments_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/187/comments","events_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/187/events","html_url":"https://github.com/bugcrowd/vulnerability-rating-taxonomy/issues/187","id":351239941,"node_id":"MDU6SXNzdWUzNTEyMzk5NDE=","number":187,"title":"Add Missing CAPTCHA","user":{"login":"plr0man","id":24785104,"node_id":"MDQ6VXNlcjI0Nzg1MTA0","avatar_url":"https://avatars0.githubusercontent.com/u/24785104?v=4","gravatar_id":"","url":"https://api.github.com/users/plr0man","html_url":"https://github.com/plr0man","followers_url":"https://api.github.com/users/plr0man/followers","following_url":"https://api.github.com/users/plr0man/following{/other_user}","gists_url":"https://api.github.com/users/plr0man/gists{/gist_id}","starred_url":"https://api.github.com/users/plr0man/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/plr0man/subscriptions","organizations_url":"https://api.github.com/users/plr0man/orgs","repos_url":"https://api.github.com/users/plr0man/repos","events_url":"https://api.github.com/users/plr0man/events{/privacy}","received_events_url":"https://api.github.com/users/plr0man/received_events","type":"User","site_admin":false},"labels":[{"id":773786475,"node_id":"MDU6TGFiZWw3NzM3ODY0NzU=","url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/labels/taxonomy%20change","name":"taxonomy change","color":"a6fcb9","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/milestones/5","html_url":"https://github.com/bugcrowd/vulnerability-rating-taxonomy/milestone/5","labels_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/milestones/5/labels","id":3194232,"node_id":"MDk6TWlsZXN0b25lMzE5NDIzMg==","number":5,"title":"v1.5","description":null,"creator":{"login":"plr0man","id":24785104,"node_id":"MDQ6VXNlcjI0Nzg1MTA0","avatar_url":"https://avatars0.githubusercontent.com/u/24785104?v=4","gravatar_id":"","url":"https://api.github.com/users/plr0man","html_url":"https://github.com/plr0man","followers_url":"https://api.github.com/users/plr0man/followers","following_url":"https://api.github.com/users/plr0man/following{/other_user}","gists_url":"https://api.github.com/users/plr0man/gists{/gist_id}","starred_url":"https://api.github.com/users/plr0man/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/plr0man/subscriptions","organizations_url":"https://api.github.com/users/plr0man/orgs","repos_url":"https://api.github.com/users/plr0man/repos","events_url":"https://api.github.com/users/plr0man/events{/privacy}","received_events_url":"https://api.github.com/users/plr0man/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":24,"state":"open","created_at":"2018-03-16T19:28:02Z","updated_at":"2018-08-23T18:25:50Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2018-08-16T14:51:11Z","updated_at":"2018-08-23T21:46:15Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"It is a common occurrence that researchers report lack of CAPTCHA as a security vulnerability despite any rate limits that there might be (see `Server Security Misconfiguration` > `No Rate Limiting on Form`). Since CAPTCHA's with their downsides might be an extra layer of security, but lack of one by itself is not a security vulnerability let's consider adding a new entry.\r\n\r\nCurrently these are the CAPTCHA entries available in the VRT:\r\nP4 – `Server Security Misconfiguration` > `Captcha Bypass` > `Implementation Vulnerability`\r\nP5 – `Server Security Misconfiguration` > `Captcha Bypass` > `Brute Force`\r\nP5 – `External Behavior` > `Captcha Bypass` > `Crowdsourcing`\r\nP5 – `Using Components with Known Vulnerabilities` > `Captcha Bypass` > `OCR (Optical Character Recognition)`\r\n\r\nPotential classification:\r\nP5 – `Server Security Misconfiguration` > `Captcha Bypass` > `Missing Captcha`"},"comment":{"url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/comments/415581523","html_url":"https://github.com/bugcrowd/vulnerability-rating-taxonomy/issues/187#issuecomment-415581523","issue_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/187","id":415581523,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTU4MTUyMw==","user":{"login":"trimkadriu","id":1461799,"node_id":"MDQ6VXNlcjE0NjE3OTk=","avatar_url":"https://avatars2.githubusercontent.com/u/1461799?v=4","gravatar_id":"","url":"https://api.github.com/users/trimkadriu","html_url":"https://github.com/trimkadriu","followers_url":"https://api.github.com/users/trimkadriu/followers","following_url":"https://api.github.com/users/trimkadriu/following{/other_user}","gists_url":"https://api.github.com/users/trimkadriu/gists{/gist_id}","starred_url":"https://api.github.com/users/trimkadriu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trimkadriu/subscriptions","organizations_url":"https://api.github.com/users/trimkadriu/orgs","repos_url":"https://api.github.com/users/trimkadriu/repos","events_url":"https://api.github.com/users/trimkadriu/events{/privacy}","received_events_url":"https://api.github.com/users/trimkadriu/received_events","type":"User","site_admin":false},"created_at":"2018-08-23T21:46:15Z","updated_at":"2018-08-23T21:46:15Z","author_association":"NONE","body":"+1 for adding this new entry as it will serve for better transparency.\r\nTechnically, if there is a `missing captcha` then there is no `bypass` of it. So I would suggest to rename the subcategory to `CAPTCHA` while I would leave the other variants as is."}}
{"actor":{"display_login":"trimkadriu"}}