POJIA破甲
地图 / CSRF on "Set as primary" option on the accounts page

CSRF on "Set as primary" option on the accounts page

跨站请求伪造 / 跨站请求伪造 / #10563

厂商
Coinbase
严重程度
未评级
赏金
$100
弱点
跨站请求伪造
研究员
@anshuman_bh
披露日期
2014-07-26
资产
—
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1227 字符中的一小部分)
On navigating to the Accounts page, a Coinbase user can create multiple accounts. The user can then make any of these accounts as their primary account. There are also other options of renaming and deleting these accounts.

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Coinbase 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @anshuman_bh · 版权归作者与 Coinbase 所有

同类报告

[CSRF] TikTok Careers Portal Account TakeoverTikTok · 2020-12-15CSRF on connecting Paypal as Payment ProviderShopify · 2020-04-10Account Takeover using Linked Accounts due to lack of CSRF protectionRockstar Games · 2019-02-20Periscope android app deeplink leads to CSRF in follow actionX / xAI · 2020-02-21 · $1,540Take over of accounts created using Google or FacebookKhan Academy · 2019-05-17Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneHackerOne · 2023-06-19