A security analyst is examining threats with the following code function: Which of the following threats should the security analyst report1?

Question

Exhibit

Options

• APOST should be used instead of GET when making requests
• BRoot privileges are needed for the service to bind to the privileged port 8443
• CThe website allows unauthorized access to sensitive resources
• DThe web server allows insecure cookie storage
• EThere is unsafe execution of third-party JavaScript code

• A
  3% (1)
• B
  6% (2)
• C
  15% (5)
• D
  27% (9)
• E
  48% (16)

Explanation

Although the code is not visible in this question, the correct answer points to unsafe execution of third-party JavaScript - a classic vulnerability involving the use of eval() or dynamic script injection to execute externally sourced or user-supplied JavaScript. This is a high-severity finding because it can enable cross-site scripting (XSS) or arbitrary code execution in the browser context. Option A (using POST vs GET) is a best-practice concern but not a critical vulnerability. Option B (binding to port 8443) does not require root on most systems since 8443 is above the privileged port threshold of 1024. Option C (unauthorized access) would require evidence of missing authentication. Option D (insecure cookie storage) is a separate issue. The unsafe execution of third-party JavaScript represents a direct code-level injection risk and is the most critical finding to report.

No community discussion yet for this question.