Detections
Analytics

Deprecated Content Security Policy

low Web App Scanning Plugin ID 112552

Language:

Synopsis

Deprecated Content Security Policy

Description

Content Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.

X-Content-Security-Policy and X-Webkit-CSP HTTP headers are deprecated to implement CSP.

Solution

Avoid using X-Content-Security-Policy and X-Webkit-CSP HTTP headers and configure Content Security Policy on your website by adding 'Content-Security-Policy' HTTP header or meta tag http-equiv='Content-Security-Policy'.

See Also

https://content-security-policy.com/

https://csp-evaluator.withgoogle.com/

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

https://developers.google.com/web/fundamentals/security/csp/

Plugin Details

Severity: Low

ID: 112552

Type: remote

Published: 2/14/2019

Updated: 4/22/2024

Scan Template: basic, config_audit, full, overview, pci, quick, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.2

CVSS v2

Risk Factor: Low

Base Score: 2.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Low

Base Score: 3.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

Reference Information