The redirection link on an empty cart page used non-validated user input, which makes it possible to use URL parameters to inject JavaScript code into the page. Cookies and other information could be sent to the attacker, who was impersonating a customer. Part of patch SUPEE-6285 This vulnerability affects the following application versions:... Weiterlesen: [APPSEC-1005] Cross-site scripting in cart
Intelligence View
⚡ tsecurity.de Intelligence
[APPSEC-1005] Cross-site scripting in cart
The redirection link on an empty cart page used non-validated user input, which makes it possible to use URL parameters to inject JavaScript code into the…
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar