2

PCI scan in our servers recently failed due to cross-site scripting vulnerability in Magento 2 pages. They have requested like below to reproduce the issue.

REQUEST:
GET /2018-2019-random-url.html?<script>alert('TK00000031')</script> HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: example.com
Content-Type: text/html
Content-Length: 0

Evidence: <script>alert('TK00000031')</script>

But we couldn't reproduce it in any browsers. Only in IE it detects it's cross-site scripting and stops the execution of the page.

Does anyone faced the same issue and got the resolution?

Improve this question
3
  • You found the solution?
    – Keyur Shah
    Dec 3, 2018 at 11:44
  • No, We even tried updating the Magento to v2.2.6. Still, the PCI scan fails with this error.
    – subash
    Dec 7, 2018 at 6:41
  • yes, we are facing the same issue :( keep updated If you have more info on this
    – Keyur Shah
    Dec 7, 2018 at 10:33

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.