Cross-Site Scripting (XSS)

2023-04-2016:02:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

vulnerability

sanitization

redirect url

reflection

software

EPSS

0.001

Percentile

36.1%

JSON

pay is vulnerable to Cross-Site Scripting (XSS). The vulnerability is caused by a lack of sanitization due to the back parameter in payments_controller.rb which allows an attacker to inject an arbitrary redirect URL resulting in reflected Cross-site scripting.