Burp Scanner Report

Summary

The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low, Information or False Positive. This reflects the likely impact of each issue for a typical organization. Issues are also classified according to confidence as Certain, Firm or Tentative. This reflects the inherent reliability of the technique that was used to identify the issue.

    Confidence
    Certain Firm Tentative Total
Severity High 1 0 0 1
Medium 0 0 0 0
Low 0 0 0 0
Information 0 0 0 0
False Positive 0 0 0 0

The chart below shows the aggregated numbers of issues identified in each category. Solid colored bars represent issues with a confidence level of Certain, and the bars fade as the confidence level falls.

    Number of issues
    0 1 2 3 4
Severity High
 
Medium
 
Low
 

Contents

1. Cross-origin resource sharing: arbitrary origin trusted


1. Cross-origin resource sharing: arbitrary origin trusted

Summary

 Severity:   High
Confidence:   Certain
Host:   https://www.human.de
Path:   /cdn-cgi/rum

Issue detail

The application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain.

The application allowed access from the requested origin https://tmdxlklpwswn.com

Issue background

An HTML5 cross-origin resource sharing (CORS) policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of the request.

Trusting arbitrary origins effectively disables the same-origin policy, allowing two-way interaction by third-party web sites. Unless the response consists only of unprotected public content, this policy is likely to present a security risk.

If the site specifies the header Access-Control-Allow-Credentials: true, third-party sites may be able to carry out privileged actions and retrieve sensitive information. Even if it does not, attackers may be able to bypass any IP-based access controls by proxying through users' browsers.

Issue remediation

Rather than using a wildcard or programmatically verifying supplied origins, use a whitelist of trusted domains.

References

Vulnerability classifications

Request

POST /cdn-cgi/rum? HTTP/2
Host: www.human.de
Cache-Control: max-age=0
Sec-CH-UA: "Chromium";v="139", "Not;A=Brand";v="24", "Google Chrome";v="139"
Sec-CH-UA-Mobile: ?0
Sec-CH-UA-Platform: "Windows"
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Accept: */*
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: cf_clearance=rd6Pv8WBgCrxqpDhBZjCzc.Xfn7atjUVSGdvUtIvVzI-1756723592-1.2.1.1-i8pv9r4DvSPntiauSOOn8ShwFymTJvRNnmWMA4UAZiZ_FMRxkewovQtHAwPB78ZuhghjVwuYCVKjYQi9peXyUOWyviWghSkr5URn84.7kB6k8xlA.6rbF2mHpqIOtODiEHG.zFJs2ac__MsiX3soHouxu6w98NdURXQVmGlhJq5PRfsEp4OzjJWJYSLytrya.dC8hA7.u1QP4jPSVW0xcY.V6VhT3KBmQys4fCdJzDY; ph_phc_pWbZNzPqZNfDdzSRawu2Tijpq10cjB5IKjVb22kMqyb_posthog=%7B%22distinct_id%22%3A%22019904e2-f0b3-7e6e-9aff-539d9fedadb1%22%2C%22%24sesid%22%3A%5B1756723605811%2C%22019904e2-f0b0-73f6-90c1-f5976b6d7583%22%2C1756723605680%5D%7D
Origin: https://tmdxlklpwswn.com
Referer: https://www.human.de/en
Content-Type: application/json
Content-Length: 1162

{"referrer":"","eventType":3,"versions":{"js":"2024.6.1","fl":"2024.11.0"},"pageloadId":"c8141a54-daa2-413a-8c8d-02312b01eb5c","location":"https://www.human.de/en","landingPath":"/en","startTime":1756723591331.9,"nt":"navigate","siteToken":"b234ddd26a5949c991f656e13093e0bf","lcp":{"value":1012,"path":"/en","element":"div.top-flex>div.top-container>picture.background-image.desktop-image>img","size":1574400,"url":"https://www.human.de/_default_upload_bucket/Slider/71444/image-thumb__71444__fix-height-920/HumaFIA%20Slider_4_4.4f3afb54.avif","rld":21.59999999962747,"rlt":282.59999999962747,"erd":605.6999999992549,"it":"img","fp":null},"fid":{"value":-1},"cls":{"value":0.0049764904289088625,"path":"/en","element":"html>body>div.cookie-consent-banner-wrapper.open","currentRect":{"x":1036,"y":674,"width":884,"height":406,"top":674,"right":1920,"bottom":1080,"left":1036},"previousRect":{"x":1096,"y":758,"width":800,"height":298,"top":758,"right":1896,"bottom":1056,"left":1096}},"fcp":{"value":432,"path":"/en"},"ttfb":{"value":102.10000000149012,"path":"/en"},"inp":{"value":-1},"timingsV2":{"transferSize":329901,"decodedBodySize":329601},"dt":"","st":1}

Response

HTTP/2 204 No Content
Date: Mon, 01 Sep 2025 10:47:35 GMT
Content-Type: text/plain
Access-Control-Allow-Origin: https://tmdxlklpwswn.com
Access-Control-Allow-Methods: POST,OPTIONS
Access-Control-Max-Age: 86400
Vary: Origin, accept-encoding
Access-Control-Allow-Credentials: true
Expect-Ct: max-age=86400, enforce
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8x6UwJmDSSVN5BDnrZaKZQdD47EnaqERBa7pUnB%2FiRQry8YTisjeWwySGJPSoHVNklxxlVpT%2BMTFw1mNwXkXsgKOvQzggQvtof%2FX"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
Cf-Ray: 978430bdccb036dd-FRA
Alt-Svc: h3=":443"; ma=86400


Report generated by Burp Suite web vulnerability scanner v2025.7.4, at Wed Sep 03 10:35:54 CEST 2025.