Content Security Policy (CSP) Nonce Value Not Used Within Single Quotes

Severity:

Information

Summary

Invicti detected that the nonce value declared in CSP is not within single quotes.

Impact

When nonce value is not used within single quotes, it will be considered as a part of the resource URL. This will cause relevant script block to not run.

Remediation

Use nonce values within single quotes, i.e.

Content-Security-Policy: script-src 'nonce-EDNnf03nceIOfn39fn3e9h3sdfa';

Required Skills for Successful Exploitation

Actions To Take

Classifications

Vulnerability Index

You can search and find all vulnerabilities

Select Category

Select Vulnerability

Related Vulnerabilities

Tableau Server Detected

Remote File Inclusion

Version Disclosure (NuSOAP)

MathJax Identified

Version Disclosure (ClipBucket)

Content Security Policy (CSP) Nonce Value Not Used Within Single Quotes

Vulnerability Index

Select Category

Select Vulnerability

Featured resources

Build your resistance to threats. And save hundreds of hours each month.