B - Production Support » BSN CDB Support

At the time of assessment, LGMS security team identified that it is possible to access password protected functions using only biometric authentication.

The mobile application does not protect functions properly. In some cases, function level protection is managed via configuration, and the system is misconfigured. In others, developers must include the proper code checks, but may potentially overlook it.

When an attacker claims to have a given identity, the application does not prove or insufficiently proves that the identity is correct. Such flaws allow attackers to access unauthorized functionality. Administrative functions are usually key targets for this type of attack.

Action Plan:
To check on session table
(Table : bib user security)