Detections
Analytics

Disclosed US Social Security Number

medium Web App Scanning Plugin ID 98920

Language:

Synopsis

Disclosed US Social Security Number

Description

The US Social Security Number (SSN) is a personally identifiable number that is issued to its citizens. A stolen or leaked SSN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an SSN located within the response of the affected page

Solution

Initially, the SSN within the response should be checked to ensure its validity, as it is possible that the regular expression has matched on a similar number with no relation to a real SSN. If the response does contain a valid SSN, then all efforts should be taken to remove or further protect this information. This can be achieved by removing the SSN altogether, or by masking the number so that only the last few digits are present within the response. (eg. _**********123_).

See Also

http://www.ssa.gov/pubs/10064.html

https://en.wikipedia.org/wiki/Social_Security_number#Identity_theft

Plugin Details

Severity: Medium

ID: 98920

Type: remote

Published: 7/17/2019

Updated: 7/20/2022

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.9

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information