Missing object-src in CSP Declaration
Severity: Information
Summary #
Netsparker detected that object-src is missed in CSP declaration. It allows the injection of plugins which can execute JavaScript.
Remediation #
Set object-src to 'none' in CSP declaration:
Content-Security-Policy: object-src 'none';
Classifications #
CWE-16, ISO27001-A.14.2.5, WASC-15, OWASP PC-C9
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Tags
