Overcome Weak Content Security Policy

Detailing to the Client for fix ID Vulnerability Severity Vulnerability Outcome/ Business Impact Ask to IBM

1 Weak Content Security Policy (CSP)
Configuration Major Weak CSP directives ('unsafe-inline' and 'unsafe-eval') reduce the effectiveness of browser-side security controls. If an XSS vulnerability exists elsewhere in the application, attackers may execute arbitrary JavaScript, leading to session hijacking, account compromise, unauthorized actions, and data theft.

Remove 'unsafe-inline' and 'unsafe-eval' from CSP policies. Implement nonce-based (nonce- <dynamic-value>) or hashbased SP. Restrict script execution to trusted sources only and set object-src 'none'.

2 Improper Input Validation
(Display Name Field)
Major
The application accepts and stores HTML content without proper validation. Although execution was not observed during esting, stored malicious input may become executable in future application changes, alternative rendering contexts, APIs, or integrations, potentially leading to Stored XSS attacks and data integrity issues.

Implement strict serverside whitelist validation. Restrict display name input to approved characters (e.g., alphanumeric, underscores, hyphens). Sanitize user input before storage and maintain output encoding across all application contexts.

ID Vulnerability Severity Vulnerability Outcome
/ Business Impact Ask to IBM
3 Vulnerable and Outdated Component
(DOMPurify 3.0.5)
Major
Use of a vulnerable third-party component exposes the application to publicly known security weaknesses. Known DOMPurify
bypass vulnerabilities may allow malicious content to evade sanitization controls, potentially resulting in Cross-Site Scripting (XSS), security control bypass, and increased attack surface.

Upgrade DOMPurify to version 3.1.3 or later (preferably the latest supported version). Perform dependency reviews, implement
Software Composition Analysis (SCA), integrate dependency scanning into CI/CD pipelines, and establish a formal patchmanagement process.

4
Background
State Data
Protection
Issue
Major
Sensitive information
remains visible when
the application is moved
to the background or
viewed in the recentapps screen.
Unauthorized
individuals with physical
access to the device
may view confidential
user data, resulting in
privacy violations,
information disclosure,
regulatory noncompliance, and
reputational impact.
Implement screen
masking or blur overlays
when the application
enters the background.
Require biometric
authentication or reauthentication upon
resume. Clear sensitive
data from memory where
feasible and implement
session timeout controls
for inactive sessions.