Details
Alert ID 100018
Alert Type Script Passive
Status alpha
Risk Medium
CWE 20
WASC 13
Technologies Targeted All
Tags CWE-20
More Info Scan Rule Help

Summary

Potential RPO (Relative Path Overwrite) found. RPO allows attackers to manipulate URLs to include unintended paths, potentially leading to the execution of malicious scripts or the disclosure of sensitive information.

Solution

Use absolute paths in URLs and resources to prevent manipulation. Validate and sanitize all user inputs that are used to construct URLs.

Other Info

References

Code

passive/RPO.js