Re: [WEB SECURITY] Severity Rating of Cross Site Scripting

[Achim Hoffmann <kirke11@xxxxxxxxxxxx>]

!! What I'm interested to know how others in the industry view XSS in
!! terms of severity rating. Are there plans to increased reported
!! severity?

here're our ratings:
  - website spoofing, frame spoofing high
  - link spoofing low ('caus the change can simply be identified by any user)
     but I guess this needs to be changed to high too 'cause of web worms
  - XSS i.g. high
  - XSS if just HTML injection low

sounds pretty much as Jeremiah's new rating ..

{-; Achim



----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]