Kotlin

This article covers Kotlin support and vulnerability detection for Mend SAST.

Mend SAST-supported Kotlin file types

File Type
.kt
.ktm
.kts

Mend SAST-supported Kotlin frameworks

Framework
Micronaut

Mend SAST-supported Kotlin vulnerability types

The Kotlin vulnerability types detected by SAST are provided below, organized by CWE ID within each of their identified severities.

Kotlin high-severity vulnerability types

CWE	Vulnerability Type
CWE-22	Path/Directory Traversal
CWE-73	File Manipulation
CWE-78	Command Injection
CWE-79	Cross-Site Scripting
CWE-89	SQL Injection
CWE-94	Code Injection
CWE-94	Server Pages Execution
CWE-502	Deserialization of Untrusted Data
CWE-643	XPath Injection
CWE-918	Server-Side Request Forgery

Kotlin medium-severity vulnerability types

CWE	Vulnerability Type
CWE-90	LDAP Injection
CWE-209	Log Messages Information Leak
CWE-209	Error Messages Information Exposure
CWE-209	Console Output
CWE-244	Heap Inspection
CWE-338	Weak Pseudo-Random
CWE-400	Sleep Denial of Service
CWE-400	Regex Denial of Service (ReDoS)
CWE-472	Hidden HTML Input
CWE-501	Trust Boundary Violation
CWE-611	XML External Entity (XXE) Injection
CWE-676	Miscellaneous Dangerous Functions
CWE-798	Hardcoded Password/Credentials

Kotlin low-severity vulnerability types

CWE	Vulnerability Type
CWE-20	Session Poisoning
CWE-20	System Properties Change
CWE-20	Mail Relay
CWE-20	Cookie Injection
CWE-113	HTTP Header Injection
CWE-113	HTTP Response Splitting
CWE-117	Log Forging
CWE-326	Weak Encryption Strength
CWE-434	File Upload
CWE-497	System Properties Disclosure
CWE-530	Dangerous File Extensions
CWE-601	Unvalidated/Open Redirect
CWE-916	Weak Hash Strength
CWE-941	Arbitrary Server Connection
CWE-1004	Cookie Without 'HttpOnly' Flag