043 – Insecure or unset HTTP headers - Content-Security-Policy
Description
The application has unsafe configurations regarding the Content-Security-Policy header. This may be because: - Header is missing from server responses. - The header has not defined mandatory security policies. - Defined security policies contain insecure values.
Impact
- Embed content, scripts, blobs or images from potentially malicious sources. - Make possible to carry attacks like Cross-Site Scripting, Cross-Site Leaks, among others.
Recommendation
Set the Content-Security-Policy header in the server responses and configure it in a secure way.
Threat
Unauthorized attacker from Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: H
- Attack Requirements: N
- Privileges required: N
- User interaction: P
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: P