Summary

Acunetix 360 detected that the Referrer-Policy is defined empty.

Impact

In the situation that the Referrer-Policy is defined empty, the fallback mechanism comes into play and the Referer information will be controlled by meta or rel attribute of each parameter from which traffics originated to cross-sites.

Remediation

Please take into consideration that dynamically added URL into site context and also add adequate control for the current HTML-elements by using alternatives below --if these controls cause cross-site requests:

<meta name="referrer" value=""/>
<img referrerpolicy="" src=""/>
<a href referrerpolicy="" href=""></a>
<a href rel="" href=""></a>

Severity

Information

Classification

CWE-200 ISO27001-A.14.2.5 OWASP 2013-A6 OWASP 2017-A6