CSP header not implemented

Description

During the scan, Kayran managed to find that a CSP header is not implemented.
Incorrectly configured CSP (Content Security Policy) could expose an application to client-side threats including Cross-Site Scripting (XSS), Cross Frame Scripting, and Cross-Site Request Forgery and so on.

Configuring Content Security Policy (CSP header) involves the CSP HTTP header to a certain Web page. It also involves giving values ​​to control what resources the user agent is allowed to load for that page.

Severity/Score

CVSS Version 3.x – 4.3 Medium

Recommendation

Make sure all headers are being set up correctly and accordingly, in order to prevent this vulnerability.

Define your CSP by using a list of policies and values that states which resources your site will allow or restrict. Test your CSP to make sure it works properly. Then, implement the CSP you’ve created.

References

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

https://cwe.mitre.org/data/definitions/16.html

< Return to all Vulnerabilities

Man-In-The-Middle Attacks

Do you know these people who just push themselves into conversations?That’s Man-In-The-Middle Attacks. And from a wider angle, Man-In-The-Middle Attacks, or MITM, are built around

Read More »