Detections
Analytics
CGI Generic XSS (HTTP Headers)
low Nessus Plugin ID 46193
Language:
Synopsis
The remote web server is prone to cross-site scripting attacks.Description
The remote web server hosts CGI scripts that fail to adequately sanitize HTTP headers of malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site. Note that injecting HTTP headers needs an additional flaw or a special vector (like a Flash applet).Note that these cross-site scripting vulnerabilities are likely to be 'non persistent', also called 'reflected'.
Solution
Contact the vendor for a patch or upgrade.See Also
https://en.wikipedia.org/wiki/Cross_site_scripting#Non-persistent
http://capec.mitre.org/data/definitions/86.html
http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting
Plugin Details
Severity: Low
ID: 46193
File Name: torture_cgi_XSS_headers.nasl
Version: 1.29
Type: remote
Family: CGI abuses : XSS
Published: 4/30/2010
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests