CWE-942
Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
Impactr finds and proves whether CWE-942 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.