地图 / XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victim

XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victim

跨站请求伪造 / 跨站请求伪造 / #450796

厂商: PayPal
严重程度: 低危 · CVSS 4.7
赏金: $3,500
弱点: 跨站请求伪造
研究员: @alexbirsan
披露日期: 2019-02-07
资产: *.xoom.com
CVE: —

该报告还没有中文解读。

时间线

2018-11-27报告提交
2019-02-07公开披露

阅读 HackerOne 原文 ↗作者 @alexbirsan · 版权归作者与 PayPal 所有

同类报告

[CSRF] TikTok Careers Portal Account TakeoverTikTok · 2020-12-15 CSRF on connecting Paypal as Payment ProviderShopify · 2020-04-10 Account Takeover using Linked Accounts due to lack of CSRF protectionRockstar Games · 2019-02-20 Periscope android app deeplink leads to CSRF in follow actionX / xAI · 2020-02-21 · $1,540 Take over of accounts created using Google or FacebookKhan Academy · 2019-05-17 Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneHackerOne · 2023-06-19