Cross-site Referrer Leakage through usage of unsafe-url in Referrer-Policy

Severity:

Information

Summary

Invicti detected that the Referrer-Policy permits Referrer leakage by using unsafe-url.

If a comma-separated referrer-policy is specified in the header, fallback policy is used only if the browser does not support the set referrer-policy, which may cause Cross-site Referrer Leakage.

Impact

If any traffic occurs from this site to a cross-site, the full URL will be leaked through the Referer header in the request.

Remediation

See all available options by using links in External References and use a secure one.

Required Skills for Successful Exploitation

Actions To Take

Classifications

Vulnerability Index

You can search and find all vulnerabilities

Select Category

Select Vulnerability

Related Vulnerabilities

WordPress Theme Soaz Out Of Date

Version Disclosure (Mailman)

Version Disclosure (XRegExp)

OpenSSL Heartbleed

Version Disclosure (EfJs)

Cross-site Referrer Leakage through usage of unsafe-url in Referrer-Policy

Vulnerability Index

Select Category

Select Vulnerability

Featured resources

Build your resistance to threats. And save hundreds of hours each month.