Yahoo has addressed a cross-site scripting (XSS) flaw that, prior to May 2, existed in the commenting platforms utilized by most of its services, including travel, food, tech, security, news, TV, music, shopping and weather.
The vulnerability – which could enable information theft by simply posting a piece of code into the comments sections of the aforementioned Yahoo websites – was discovered by Behrouz Sadeghipour, an independent researcher known for hunting down bugs in popular services.
“An attacker could inject a malicious script, which could be used to obtain session tokens, cookies and other sensitive information stored in the users’ browser that is associated with Yahoo,” Satnam Narang, a Symantec researcher familiar with XSS flaws, told SCMagazine.com on Monday.
In a Friday post containing proof-of-concept videos, Sadeghipour is shown posting a…
Voir l’article original 192 mots de plus