Detections
Analytics

Disclosed European Personal Data Number

medium Web App Scanning Plugin ID 113430

Language:

Synopsis

Disclosed European Personal Data Number

Description

A European Personal Data Number (EPDN) is a personally identifiable number that is issued to a citizen of one of the members or ex-members of the European Union. A stolen or leaked EPDN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an EPDN located within the response of the affected page

Solution

Initially, the Identified EPDN within the response should be checked to ensure its validity, as it is possible that the regular expression has matched on a similar number with no relation to a real EPDN due to the wide variety of formats across the region. If the response does contain a valid EPDN, then all efforts should be taken to remove or further protect this information. This can be achieved by removing the EPDN altogether, or by masking the number so that only a few digits are present within the response. (eg. _*****123*****_).

See Also

https://en.wikipedia.org/wiki/National_identity_cards_in_the_European_Economic_Area#Overview_of_national_identity_cards

https://ipsec.pl/european-personal-data-regexp-patterns.html

https://www.liquisearch.com/national_identification_number

Plugin Details

Severity: Medium

ID: 113430

Type: remote

Published: 11/28/2022

Updated: 9/20/2023

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.9

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information