CSP Misconfiguration
Medium · Configuration
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-1021
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-1021
Definition
Content-Security-Policy allows unsafe-inline or overly broad sources.
Root cause
Weak script-src/default-src directives.
Affected components
- Components in the “Configuration” class
- Application / API handlers
- Supporting libraries
Impact
XSS still exploitable despite CSP present.
Severity
Medium · CVSS 6.1
Safe lab reproduction
In-browser lab-csp
Detection methodology
Review CSP headers; CSP evaluators.
Evidence examples
- Lab reproduction notes: In-browser lab-csp
- Request/response excerpts (redacted)
- Detection signal: Review CSP headers; CSP evaluators
Remediation
Use nonces/hashes; remove unsafe-inline.
Secure coding examples
Strict CSP with reporting (report-uri/report-to).
Related CYNARKS lessons & labs
Tools: browser-devtools
Practise related skills in Labs or deepen on Academy library.