Question

A development team is building a cloud-native SaaS application that stores customer payment card numbers and personal data in a managed database. During a security review, an assessor notes that the application transmits session tokens over HTTPS but stores card numbers in the database as plaintext, and the application logs include full card numbers for debugging. Which OWASP Top 10 category best describes this finding, and what is the most appropriate remediation?

Accepted Answer

Cryptographic Failures — encrypt cardholder data at rest, remove sensitive data from logs, and apply tokenization or field-level encryption to reduce exposure

Answer

Security Misconfiguration — harden the database instance by disabling default accounts and closing unused ports

Answer

Broken Access Control — restrict which application roles can query the payment table

Answer

Injection — parameterize database queries to prevent attackers from extracting card numbers