# Web Server Generic XSS **URL:** \ **Category:** Elasticsearch\ **Created:** [March 15, 2019, 8:54am UTC](https://discuss.elastic.co/t/web-server-generic-xss/172488 "2019-03-15T08:54:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Nishant\_Suman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nishant_suman/32/42083_2.png) [@Nishant\_Suman](https://discuss.elastic.co/u/Nishant_Suman)\ **Post date:** [March 15, 2019, 8:54am UTC](https://discuss.elastic.co/t/web-server-generic-xss/172488/1 "2019-03-15T08:54:33Z")
We have hosted a dockerized elastic stack in AWS ec2 instance and ran nessus scan on that instance. In the report of nessus scan, Web Server Generic XSS vulnerability is detected in elasticsearch. Currently we are using 6.6.1 version. ![08%20PM](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96908f5a94c0bc52ef97fbe50b37dfc12ebf1c83.png) ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 15, 2019, 9:32am UTC](https://discuss.elastic.co/t/web-server-generic-xss/172488/2 "2019-03-15T09:32:22Z")
Hi there, Please do _not_ open public topics on potential security issues, we have a documented process for reporting these through : [https://www.elastic.co/community/security](https://www.elastic.co/community/security) Regarding this specific one though, it's a false positive. Elasticsearch uses the HTTP protocol to service json requests via APIs. As such, when there is a bad request, we return a descriptive error message that often contains portions of the request passed to the API. It is common for some security scanners to incorrectly interpret this as an XSS. If the actual response is investigated it should have a content-type of json and indeed be returning json content. Web browsers will not interpret this as HTML. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 15, 2019, 9:38am UTC](https://discuss.elastic.co/t/web-server-generic-xss/172488/3 "2019-03-15T09:38:22Z")
---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 15, 2019, 9:38am UTC](https://discuss.elastic.co/t/web-server-generic-xss/172488/4 "2019-03-15T09:38:40Z")
---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 12, 2019, 9:38am UTC](https://discuss.elastic.co/t/web-server-generic-xss/172488/5 "2019-04-12T09:38:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.