Weak Nonce Detected in Content Security Policy (CSP) Declaration
Severity:
Information
Summary
Invicti detected that a weak nonce value used in CSP declaration.
Impact
An attacker can carry out a successful Cross-site Scripting attack by predicting a valid nonce by exploiting this weakness.
Remediation
The application must generate a fresh value for the nonce-value directive at random and independently each time it transmits a policy. The value should be at least 128 bits long and should be generated using a cryptographically secure random number generator.
Required Skills for Successful Exploitation
Actions To Take
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Featured resources
Build your resistance to threats. And save hundreds of hours each month.
