Summary #

Invicti identified a cookie used as Anti-CSRF Token.

Impact #
During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session even if cookie is marked as HttpOnly. If the cookie is not the session cookie you can ignore this issue.
Remediation #
Avoid the usage of session cookie as Anti-CSRF Token.
Classifications #
CWE-352; HIPAA-164.306(a); ISO27001-A.14.1.2; OWASP 2013-A5; OWASP 2017-A6
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities


Search Vulnerability


Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo