/**
 * Cyber-Assistant — Pack de référentiel : OWASP API Security Top 10 2023 — sélection (2023 (sélection 6/10))
 * GÉNÉRÉ depuis BROUILLON-PACKS-L4-2026-08-04.md (validation PO du 04/08 —
 * délégation de confiance). Données GÉNÉRIQUES, aucune donnée client.
 * Lecture seule — cf. modules/threat-catalog.js et l'étude §4.
 */
(function () {
  'use strict';
  window._csiThreatCatalogs = window._csiThreatCatalogs || {};
  window._csiThreatCatalogs["owasp-api-2023"] =
  {
    "meta": {
      "id": "owasp-api-2023",
      "name": "OWASP API Security Top 10 2023 — sélection",
      "nameEn": "OWASP API Security Top 10 2023 — Selection",
      "nameNl": "OWASP API Security Top 10 2023 — selectie",
      "version": "2023 (sélection 6/10)",
      "publishedAt": "2023-06",
      "sourceDocument": "OWASP API Security Top 10 2023",
      "organization": "OWASP Foundation",
      "kind": "vulnerability",
      "natureKind": "Classes de faiblesses API",
      "natureKindEn": "API weakness classes",
      "natureKindNl": "Klassen van API-zwakheden",
      "licence": "Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)",
      "disclaimer": "Les intitulés des catégories sont ceux de l'OWASP API Security Top 10 2023, © OWASP Foundation, sous licence CC BY-SA 4.0 (attribution requise, partage dans les mêmes conditions). Sélection de 6 catégories sur 10 : les 4 écartées (API5, API7, API8, API10) recoupent le pack OWASP Top 10:2025. Les scénarios, traductions et cotations par défaut sont rédigés par Cyber-Assistant et ne sont ni produits ni endossés par l'OWASP Foundation.",
      "disclaimerEn": "Category titles are those of the OWASP API Security Top 10 2023, © OWASP Foundation, licensed under CC BY-SA 4.0 (attribution required, share-alike). Selection of 6 out of 10 categories: the 4 omitted ones (API5, API7, API8, API10) overlap the OWASP Top 10:2025 pack. Scenarios, translations and default ratings are authored by Cyber-Assistant and are neither produced nor endorsed by the OWASP Foundation."
    },
    "threats": [
      {
        "id": "API23_1_T",
        "ref": "API1:2023",
        "label": "Défaillance d'autorisation au niveau des objets (BOLA)",
        "labelEn": "Broken Object Level Authorization",
        "labelNl": "Gebrekkige autorisatie op objectniveau (BOLA)",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "SDLC",
          "LOG"
        ],
        "defaults": {
          "likelihood": 4,
          "impact": 4
        }
      },
      {
        "id": "API23_2_T",
        "ref": "API2:2023",
        "label": "Authentification défaillante",
        "labelEn": "Broken Authentication",
        "labelNl": "Gebrekkige authenticatie (API)",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "API23_3_T",
        "ref": "API3:2023",
        "label": "Défaillance d'autorisation au niveau des propriétés",
        "labelEn": "Broken Object Property Level Authorization",
        "labelNl": "Gebrekkige autorisatie op eigenschapsniveau",
        "adversarial": true,
        "domainHints": [
          "SDLC",
          "IAM",
          "DATA"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "API23_4_T",
        "ref": "API4:2023",
        "label": "Consommation de ressources non restreinte",
        "labelEn": "Unrestricted Resource Consumption",
        "labelNl": "Onbeperkt verbruik van middelen",
        "adversarial": true,
        "domainHints": [
          "NETCRYPTO",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "API23_6_T",
        "ref": "API6:2023",
        "label": "Accès non restreint aux flux métier sensibles",
        "labelEn": "Unrestricted Access to Sensitive Business Flows",
        "labelNl": "Onbeperkte toegang tot gevoelige bedrijfsstromen",
        "adversarial": true,
        "domainHints": [
          "NETCRYPTO",
          "SDLC",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "API23_9_T",
        "ref": "API9:2023",
        "label": "Gestion d'inventaire défaillante",
        "labelEn": "Improper Inventory Management",
        "labelNl": "Gebrekkig inventarisbeheer",
        "adversarial": true,
        "domainHints": [
          "VULN",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      }
    ],
    "scenarios": [
      {
        "id": "API23_1",
        "threatId": "API23_1_T",
        "ref": "API1:2023",
        "label": "Un consommateur d'API accède aux objets d'autres clients en changeant simplement un identifiant",
        "labelEn": "An API consumer reaches other customers' objects by simply changing an identifier",
        "labelNl": "Een API-gebruiker bereikt objecten van andere klanten door louter een identifier te wijzigen",
        "domainHints": [
          "IAM",
          "SDLC",
          "LOG"
        ],
        "defaults": {
          "likelihood": 4,
          "impact": 4
        }
      },
      {
        "id": "API23_2",
        "threatId": "API23_2_T",
        "ref": "API2:2023",
        "label": "Jetons d'API faibles, sans expiration ou volés permettant d'appeler l'API comme un client légitime",
        "labelEn": "Weak, non-expiring or stolen API tokens allowing calls as a legitimate client",
        "labelNl": "Zwakke, niet-verlopende of gestolen API-tokens laten aanroepen toe als legitieme klant",
        "domainHints": [
          "IAM",
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "API23_3",
        "threatId": "API23_3_T",
        "ref": "API3:2023",
        "label": "L'API expose ou accepte des propriétés sensibles interdites en lecture ou en écriture",
        "labelEn": "The API exposes or accepts sensitive properties forbidden to read or write",
        "labelNl": "De API toont of aanvaardt gevoelige eigenschappen die niet gelezen of gewijzigd mogen worden",
        "domainHints": [
          "SDLC",
          "IAM",
          "DATA"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "API23_4",
        "threatId": "API23_4_T",
        "ref": "API4:2023",
        "label": "Appels massifs sans quota ni limite saturant l'API et générant des coûts incontrôlés",
        "labelEn": "Massive calls without quotas or limits flooding the API and driving uncontrolled costs",
        "labelNl": "Massale aanroepen zonder quota of limieten overbelasten de API en veroorzaken ongecontroleerde kosten",
        "domainHints": [
          "NETCRYPTO",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "API23_6",
        "threatId": "API23_6_T",
        "ref": "API6:2023",
        "label": "Un flux métier légitime est automatisé abusivement : achat massif, réservation ou extraction systématique",
        "labelEn": "A legitimate business flow abusively automated: mass purchasing, booking or systematic scraping",
        "labelNl": "Een legitieme bedrijfsstroom wordt abusievelijk geautomatiseerd: massale aankoop, reservering of systematische extractie",
        "domainHints": [
          "NETCRYPTO",
          "SDLC",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "API23_9",
        "threatId": "API23_9_T",
        "ref": "API9:2023",
        "label": "Une version d'API oubliée ou un environnement de test reste exposé sans protections de production",
        "labelEn": "A forgotten API version or test environment stays exposed without production-grade protections",
        "labelNl": "Een vergeten API-versie of testomgeving blijft blootgesteld zonder de productiebeveiligingen",
        "domainHints": [
          "VULN",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      }
    ]
  };
})();
