What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a place to download project applications.

3 Answers 3


... no user profiles on this page

XSS (including reflected XSS) can basically do everything inside the site what the user with a browser can do. If there are no user profiles it can at least not impersonate any users. Note though that if there are users on the same domain or subdomain, then XSS might use existing session cookies to impersonate the logged in user and do actions in the name of the user, no matter if these specific actions are actually included in the specific page vulnerable to reflected XSS.

... serves as an information board and a place to download project applications

XSS might also completely change the appearance of the site. And it can also change things which are not obvious, like changing the values in the shown financial information or make the download links point to malicious downloads instead. Note that these changes are only temporary in the rendered page, i.e. no server side changes are done. But if there is a way to edit such information it might be done using XSS too.


Another thing the attacker can do is "man in the browser", this is done by injecting malicious script via XSS or different way. This will allow the attacker to "hook" the browser to a remote server and control some of the functions of the browser or try to create an fake browser notification that will allow the attacker to execute malicious code on the machine itself.


The website is a trusted entity and with XSS you have control over its content. You can direct users there and show them e.g. a Download with malicious content, a Login-Form (there will be enough users that just try to log in with their e-mail account) or just a Form asking them for their personal data. You can also just post fake/controversial content on the website and share it e.g. via twitter, potentially causing harm for the site in question.

Of course, with reflected XSS, you can only change the content for users you sent there. But with Spam mails or Links going viral on twitter, the impact can still be huge.

You're just limited by your imagination.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .