{"id":5361,"date":"2024-09-17T16:55:08","date_gmt":"2024-09-17T21:55:08","guid":{"rendered":"https:\/\/www.darkreading.com\/application-security\/cisa-urges-software-makers-eliminate-xss-flaws"},"modified":"2024-09-17T16:55:08","modified_gmt":"2024-09-17T21:55:08","slug":"cisa-urges-software-makers-to-eliminate-xss-flaws","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/09\/17\/cisa-urges-software-makers-to-eliminate-xss-flaws\/","title":{"rendered":"CISA Urges Software Makers to Eliminate XSS Flaws"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

The US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are urging organizations to focus on eliminating cross-site scripting vulnerabilities in their products before shipping them.<\/span><\/p>\n

“Vulnerabilities like cross-site scripting (XSS) continue to appear in software, enabling threat actors to exploit them,” the agencies wrote in <\/span>their latest Secure by Design alert<\/a><\/span>. “[XSS] vulnerabilities are preventable and should not be present in software products.”<\/span><\/p>\n

XSS vulnerabilities occur in Web applications when the developer did not properly validate, sanitize, or escape inputs. Malicious actors can use those input fields to insert and execute malicious scripts into the application, allowing them to manipulate and steal data. XSS was rated second on MITRE’s list of top 25 most dangerous software flaws in 2022 and is also included in <\/span>OWASP Top 10<\/a><\/span>. XSS flaws can be found in around two-thirds of all applications, according to OWASP.<\/span><\/p>\n

CISA listed<\/a><\/span> the following recommendations:<\/span><\/p>\n

\n