OWASP Compliance Report

Azure Prod Blue & Bodgeit

A comprehensive analysis of OWASP Top 10 2021 coverage, active vulnerability exposure, compliance gaps, and prioritized remediation guidance derived from live DefectDojo findings data.

REPORT DATE
February 18, 2026

PRODUCTS ANALYZED
2 Assets

TOTAL FINDINGS
713 (C/H Active)

OWASP COVERAGE
10/10 Categories

Executive Summary

This report analyzes OWASP Top 10 2021 compliance across two DefectDojo-tracked production assets: Azure Prod Blue and Bodgeit. Combined, these products have confirmed vulnerabilities introduced by criticality, indicating a broad attack surface exposure. The most impactful categories are A06 (Vulnerable & Outdated Components), A05 (Security Misconfiguration), and A03 (Injection), which collectively account for over 45% of mapped Critical/High findings.

The estimated compliance score of 48% reflects that while scanning coverage is broad, active unmitigated vulnerabilities span every OWASP risk category.

OWASP Top 10 2021 — Category-by-Category Analysis

• Finding counts reflect sampled analysis (200 Azure, 100 Bodgeit findings). Total active Critical/High pool: 826 findings per product. Counts shown are representative proportional distribution. A06 is the dominant category and likely represents >50% of all findings at scale.

Category Detail — Highest Risk Findings

Azure Prod Blue's container image carries numerous unpatched CVEs in core OS packages. Multiple injection vulnerabilities are confirmed across both products, with Azure Prod Blue having direct SQL injection findings flagged by static analysis tools. Bodgeit has XSS in Django templates and direct SQL injection in Java source.

Key Vulnerabilities

• Libxml2 CVE-2025-27113 — Active library vulnerability (Bodgeit)
• CVE-2019-14697 Musl (CWE-787) — Critical container component
• CVE-2022-4135 Bash — Known Exploited (KEV listed, in-the-wild)
• CVE-2020-8425 OpenSSH — CVSS 10.0, container-level risk
• SQL Injection — Found in Bodgeit Java files

Top 3 Priority Recommendations

A06 + A03 + A10 · EMERGENCY SPRINT

1. Rebuild Azure Prod Blue container base image with updated packages to eliminate A06 CVEs.
2. Upgrade/patch Log4j on Bodgeit to remove Log4Shell vulnerabilities.
3. Remediate SQL injection in Java files (Assignment5.java, Assignment6.java).
4. Enable automated SCA scanning in CI/CD pipeline to prevent new vulnerabilities.

A05 + A07 · WITHIN 30 DAYS

1. Enable hardware MFA on AWS root account.
2. Replace self-signed SSL certificate with CA-signed certificate.
3. Fix CORS policy on Azure Prod Blue to restrict arbitrary origins.

A04 + A08 + A09 · 60–90 DAY PROGRAM

1. Initiate incident response investigation on Bodgeit malware infections.
2. Implement centralized logging for both products to meet incident response requirements.
3. Investigate and refactor vulnerable code patterns across both assets.

90-Day Remediation Roadmap

• Phase 1 (Days 1-21): Immediate remediation focusing on patching critical CVEs.
• Phase 2 (Days 22-45): Strengthening authentication and configuration settings.
• Phase 3 (Days 46-90): Integrating enhanced monitoring and logging solutions.

Success Metrics & Compliance Targets