API Developer Portal vulnerability findings - Sensitive Data in Query String Parameter

Products

• CA API Developer Portal

Issue/Introduction

A security or vulnerability scan (such as manual penetration test) flags a finding: "Sensitive Data in Query String Parameter." The report indicates that sensitive information, such as "username" and "email address," is sent to the server through URL query string parameters during administrative tasks or user filtering.

Environment

API Developer Portal 5.x

Cause

The API Developer Portal uses query parameters in GET endpoints to allow administrators to filter and search through user lists or other entities. When an administrator types a search term (e.g., a username or email) into the search bar, that value is appended to the URL as a query string parameter to execute the request.

Resolution

Broadcom Engineering has investigated this finding (Reference: DE681961) and determined that it represents a low-risk behavior rather than a security vulnerability for the following reasons:

1. Restricted Access: The identified endpoints are restricted exclusively to authenticated administrators or global users. Unauthorized or unauthenticated users cannot access these endpoints to see or manipulate these parameters.
2. Source of Data: The query parameter is not a server-generated secret (like a password or session token). It is simply a reflection of the search term the administrator typed themselves to filter the list. Since the admin is already the source of this value, there is no unauthorized data exposure.
3. Authorization Filtering: The Portal performs internal filtering based on the logged-in user’s permissions and organization. Users can only view or filter data they are already authorized to access.

Recommendation: This finding can be marked as "Risk Accepted" or "Unavoidable" in security reports, as it is a functional requirement for administrative filtering and occurs only within a secured, authenticated context.