The bundled HTML minifier derived its placeholder token from an md5 of the request timestamp, which an attacker could predict, and used a loose pattern when matching quoted data URIs. Content crafted to contain a matching placeholder could survive minification and be injected into the cached page, executing script for unauthenticated visitors. The... Weiterlesen: Stored Cross-Site Scripting in Speed Optimizer Bundled HTML Minifier
Intelligence View
⚡ tsecurity.de Intelligence
Stored Cross-Site Scripting in Speed Optimizer Bundled HTML Minifier
The bundled HTML minifier derived its placeholder token from an md5 of the request timestamp, which an attacker could predict, and used a loose pattern when…
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
Intelligence Digest — free The top security news daily · unsubscribe anytime
Community Rating & Social Proof
⭐ Leser-Wertung
Was this page helpful?