Key Banking Software Vulnerability Issues: An OWASP Top 10-Based Assessment of NVD Data (2022–2024) (Indian Journal of Computer Science and Technology)

Summary

• This study evaluated 150 vulnerability data (CVEs) from the National Vulnerability Database related to major banking software vendors.p.1
• A study of Indonesian mobile banking apps showed security maturity scores of 60/100 for myBCA and 36/100 for BRImo.p.2
• Data breach consequences can lead to legal penalties up to 4% of annual revenue under GDPR.p.2
• The empirical data extraction gathered 150 distinct CVE records from January 2022 thru December 2024 with CVSS scores of at least 4.0.p.4
• The analyzed banking software vulnerabilities had an average CVSS Severity Score of 7.1 (High).p.6
• The maximum severity level reached a CVSS score of 9.8 (Critical).p.6
• A cited API security analysis found that 83.4% of vulnerabilities were simple to exploit via network-based vectors.p.6

Key insights

1. Injection (A03) and Identification and Authentication Failures (A07) represent the most frequent vulnerability groups in core banking software.p.1
2. High enterprise scale and formal regulatory compliance do not automatically ensure reliable software security implementation.p.2
3. The sample of 150 CVE records was extracted from NVD API 2.0 specifically focusing on major financial software vendors.p.4
4. Improper Authentication (CWE-287) was determined to be the single most widespread technical weakness.p.6
5. SQL Injection (CWE-89), Cross-Site Scripting (CWE-79), Cross-Site Request Forgery (CWE-352), and Path Traversal (CWE-22) complete the top five vulnerability types.p.6
6. Quantitative research shows 83.4% of API vulnerabilities are easily exploitable over network vectors.p.6
7. Attackers prioritize exploiting flawed authentication mechanisms rather than attempting to break robust encryption protocols.p.7