Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com

业务逻辑 / 业务逻辑错误 / #381356

厂商

HackerOne

严重程度

低危 · CVSS 3.1

赏金

—

弱点

业务逻辑错误

研究员

@fransrosen

披露日期

2019-04-05

资产

www.hackerone.com

CVE

—

该报告还没有中文解读。

I made a talk earlier this month about Client-Side Race Conditions for postMessage on AppSecEU:

      form.onSuccess(function() {
        return false;
      });