PCI scan in our servers recently failed due to cross-site scripting vulnerability in Magento 2 pages. They have requested like below to reproduce the issue.

GET /2018-2019-random-url.html?<script>alert('TK00000031')</script> HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: example.com
Content-Type: text/html
Content-Length: 0

Evidence: <script>alert('TK00000031')</script>

But we couldn't reproduce it in any browsers. Only in IE it detects it's cross-site scripting and stops the execution of the page.

Does anyone faced the same issue and got the resolution?

  • You found the solution?
    – Keyur Shah
    Commented Dec 3, 2018 at 11:44
  • No, We even tried updating the Magento to v2.2.6. Still, the PCI scan fails with this error.
    – subash
    Commented Dec 7, 2018 at 6:41
  • yes, we are facing the same issue :( keep updated If you have more info on this
    – Keyur Shah
    Commented Dec 7, 2018 at 10:33


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.