Improper Neutralization Of Special Elements In Output Used By A Downstream Component ('Injection')

2024-04-0106:04:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

astro-shield

vulnerability

inadequate content validation

csp header

injection

malicious resources.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Astro-Shield is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’). The vulnerability is caused due to inadequate validation of user-controlled content, potentially allowing the inclusion of malicious resources in the generated CSP headers.