Missing Permissions-Policy header - vulnerability CWE-693OWASP

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

The missing Permissions-Policy header vulnerability (CWE-693/OWASP) was found on the UIM Server.  

Name - Missing Permission Policy

Observation - During security assessment, it was observed that the application response is missing the Permissions-Policy header.

Impact - Missing Permissions-Policy header may allow unnecessary browser features or APIs to be accessed, increasing the attack surface of the application.

Remediation - We recommend implementing the Permissions-Policy header to restrict access to sensitive browser features based on application requirements.

Reference - https://cwe.mitre.org/data/definitions/693.html

CVE/Standard - CWE-693OWASP Top 10 2025 – A06

Environment

UIM 23.4.6

Resolution

The missing permission-policy header is implemented in all the webapps to remediate the vulnerability CWE-693O. 

This fix will be available in UIM CU9 which is going to release in mid of the September 2026.