From 05c843726d5506416b2d9a38671c3b661660ed7e Mon Sep 17 00:00:00 2001 From: Pierre-Loup <49131563+pierre-loup-tristant-sonarsource@users.noreply.github.com> Date: Tue, 5 Nov 2024 17:09:53 +0100 Subject: [PATCH] Apply suggestions from code review Co-authored-by: Hendrik Buchwald <64110887+hendrik-buchwald-sonarsource@users.noreply.github.com> --- rules/S7140/secrets/rule.adoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/S7140/secrets/rule.adoc b/rules/S7140/secrets/rule.adoc index e28a4800ee2..0248d28e55e 100644 --- a/rules/S7140/secrets/rule.adoc +++ b/rules/S7140/secrets/rule.adoc @@ -9,8 +9,8 @@ If an attacker gains access to an SSLMate secret, they might be able to gain acc === What is the potential impact? -SSLMate provide API used by organizations to issue and monitor SSL/TLS certificates. -These certificate garanty the authenticity of the organization's servers and the confidentiality of the data exchanged with it. +SSLMate provides APIs used by organizations to issue and monitor SSL/TLS certificates. +These certificates guaranty the authenticity of the organization's servers, and the confidentiality of the data exchanged with them. Depending on the permission granted to the API key, an attacker could potentially create, revoke, or modify SSL/TLS certificates of the organization. Creating certificates would allow attackers to impersonate the organization's servers. This leads to Man-In-The-Middle attacks that would @@ -21,8 +21,8 @@ to that server. include::../../../shared_content/secrets/fix/revoke.adoc[] -Also revoke certificate that were issues since the leak. Doing so -will ensure that all people and assets that rely on this certificate for security +Also, revoke certificates that were issued since the leak. Doing so +will ensure that all people and assets that rely on these certificates for security operations are aware of its compromise and stop trusting it. include::../../../shared_content/secrets/fix/recent_use.adoc[]