Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Data is read from location and passed to $()

Nijish | Last updated: Jan 07, 2021 04:32AM UTC

Hi Team, Burp scan reported a vulnerability in following js statement from jquery.userTimeout.js library. Seems like a false positive, Could you please help me to understand how this can be exploited? Data is read from location and passed to $() via the following statement: var $currentReferral = $(location).attr('href'); Please suggest a fix if this is not a false positive. Thanks Nijish

Hannah, PortSwigger Agent | Last updated: Jan 07, 2021 04:46PM UTC

Hi Nijish Unfortunately, we can't provide specific assistance with fixing individual issues in people's apps or dissecting/explaining scan reports. Have you read the supporting documentation for the issue reported (https://portswigger.net/kb/issues) or had a look at our online learning material in the Web Security Academy (https://portswigger.net/web-security)? Findings should be verified through manual testing, and if found to be a false positive can be marked as such. In Burp Suite Professional, this is done by right-clicking on the issue and selecting "Set severity > False positive".

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.