Privacy (OWASP Mobile M6)

Data accessed with no consent screen, no tracking-transparency prompt, and PII flowing into analytics unfiltered.

9 vulnerabilities. OWASP Mobile: M6

VulnerabilityIDPlatformDifficultyOWASPMASVSMASWEMASTG (v2)CWE
Installed-App Enumeration (Privacy Fingerprint)installed_app_enumerationAndroidiOSEASYM6MASVS-PRIVACY-1MASVS-PRIVACY-3MASWE-0068MASTG-TEST-0255MASTG-TEST-0024CWE-359CWE-200
Missing Consent Before Data Accessmissing_consent_before_data_accessAndroidiOSEASYM6MASVS-PRIVACY-1MASVS-PRIVACY-2MASWE-0078MASTG-TEST-0360MASTG-TEST-0256CWE-359
No Tracking Transparency Promptno_tracking_transparency_promptiOSEASYM6MASVS-PRIVACY-3MASWE-0074MASTG-TEST-0281CWE-359
System Assistant -> Locked-Device Capability Abuseassistant_locked_device_capability_abuseiOSMEDIUMM6MASVS-AUTH-1MASVS-PRIVACY-1MASWE-0018-CWE-863CWE-284CWE-200
Cross-App Browser History Accesscross_app_browser_history_accessAndroidiOSMEDIUMM6MASVS-PRIVACY-1MASVS-STORAGE-2MASWE-0002MASTG-TEST-0007CWE-200CWE-359
Lock-State Confusion Data Exposurelock_state_confusion_data_exposureAndroidiOSMEDIUMM6MASVS-PLATFORM-3MASVS-PRIVACY-1MASWE-0036MASTG-TEST-0246CWE-200CWE-284CWE-863
Notification Content Disclosure via Alternate Surfacenotification_alternate_surface_disclosureAndroidiOSMEDIUMM6MASVS-PRIVACY-1MASVS-PLATFORM-3MASWE-0037MASTG-TEST-0315CWE-200CWE-359CWE-284
PII in Analytics Eventspii_in_analytics_eventsAndroidiOSMEDIUMM6MASVS-PRIVACY-1MASWE-0069MASTG-TEST-0318MASTG-TEST-0319CWE-359CWE-200
Privacy Control Alternate-Path Bypassprivacy_control_alternate_path_bypassAndroidiOSHARDM6MASVS-PRIVACY-2MASVS-PRIVACY-1MASWE-0071-CWE-284CWE-668CWE-200