From the course: The OWASP API 2023 Top 10: An Overview

Unlock the full course today

Join today to access over 24,100 courses taught by industry experts.

API6:2023 Unrestricted Access to Sensitive Business Flows

API6:2023 Unrestricted Access to Sensitive Business Flows

From the course: The OWASP API 2023 Top 10: An Overview

Start my 1-month free trial Buy for my team

API6:2023 Unrestricted Access to Sensitive Business Flows

“

- [Narrator] Next on the OWASP API Security top 10 is another newcomer. At number 6, we have unrestricted access to sensitive business flows. OWASP says API is vulnerable to this risk expose a business flow such as buying a ticket or posting a comment without compensating for how the functionality could harm the business if used excessively in an automated manner. This doesn't necessarily come from implementation bugs. This occurs when attackers gain automated access to sensitive business processes via an API and manipulate them. For example, attackers may block legitimate users from buying products or making reservations on a calendar, or automate a purchasing process to buy up inventory and resell it for a higher price. So if you've had trouble getting the latest video game consoles recently, or if you're a collector like me who has stayed up all night for the latest collector's item only to find it sold out within seconds…

Contents