Detections
Analytics
CGI Generic XSS (quick test)
medium Nessus Plugin ID 39466
Language:
Synopsis
The remote web server is prone to cross-site scripting attacks.Description
The remote web server hosts CGI scripts that fail to adequately sanitize request strings with malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site.These XSS are likely to be 'non persistent' or 'reflected'.
Solution
Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade to address any cross-site scripting vulnerabilities.See Also
https://en.wikipedia.org/wiki/Cross_site_scripting#Non-persistent
http://www.nessus.org/u?ea9a0369
http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting
Plugin Details
Severity: Medium
ID: 39466
File Name: torture_cgi_cross_site_scripting.nasl
Version: 1.45
Type: remote
Family: CGI abuses : XSS
Published: 6/19/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests