Return
-
Title
Vulnerability scan of Active Roles Web Interface shows that "The web application framework used on the remote host may be susceptible to cross-site scripting attacks" -
Description
A vulnerability scan of the Active Roles Web Interface may indicate something similar to the following:
SynopsisThe web application framework used on the remote host may be susceptible to cross-site scripting attacks.DescriptionAccording to the HTTP headers received from the remote host, the web server is configured to use the ASP.NET framework.This framework includes the ValidateRequest feature, which is used by ASP.NET web applications to filter user input in an attempt to prevent cross-site scripting attacks. However, this set of filters can be bypassed if it is the sole mechanism used for protection by a web application.SolutionDetermine if any ASP.NET web applications solely rely on the ValidateRequest feature, and use additional protections if necessary. -
Cause
The Active Roles Web Interface does use the ValidateRequest feature, but it is not the sole protection which is recommended. -
Resolution
This issue is discussed in the Active Roles Web Interface Administration Guide under the section titled Configuring Web interface forenhanced security