An attacker exploits a cross-site scripting vulnerability. What is the attacker able to do?

An attacker exploits a cross-site scripting vulnerability. What is the attacker able to do?

• A. Access the user's data
• B. Take over the server
• C. Delete all logs
• D. Bypass authentication

Answer: (A)

Cross-site scripting lets an attacker run malicious code in a victim’s browser by injecting scripts into a trusted website. That code executes with the same permissions as the user on that site, so it can read data the page can access—like form inputs, the page’s content, and cookies or session tokens stored in the browser (especially if cookies aren’t HttpOnly). With this data, the attacker can steal credentials or impersonate the user, which is effectively accessing the user’s data. So the attacker is able to access the user’s data. This isn’t the same as taking over the server or deleting logs by itself, and bypassing authentication isn’t directly granted by XSS without first compromising the user’s session or data.

Cross-site scripting lets an attacker run malicious code in a victim’s browser by injecting scripts into a trusted website. That code executes with the same permissions as the user on that site, so it can read data the page can access—like form inputs, the page’s content, and cookies or session tokens stored in the browser (especially if cookies aren’t HttpOnly). With this data, the attacker can steal credentials or impersonate the user, which is effectively accessing the user’s data.

So the attacker is able to access the user’s data. This isn’t the same as taking over the server or deleting logs by itself, and bypassing authentication isn’t directly granted by XSS without first compromising the user’s session or data.