[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: Re: [Full-disclosure] MIMESweeper For Web 5.X Cross Site Scripting
From: "Brian Eaton" <eaton.lists () gmail ! com>
Date: 2006-07-10 12:06:07
Message-ID: 242a0a8f0607100506w15abb842m76400c4cdd30cbee () mail ! gmail ! com
[Download RAW message or body]
On 7/9/06, Erez Metula <erezmetula@2bsecure.co.il> wrote:
> An example attack scenario could be that an attacker will redirect many
> users (by email, posting in the organization portal, etc.) to some blocked
> URL and an accompanying script that will steal their authentication cookies.
It sounds like the net impact of this vulnerability is that an
attacker can steal cookies for a site the user isn't allowed to visit
anyway. In other words, there aren't going to be any interesting
cookies to steal. Is there more to this attack scenario?
Regards,
Brian
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic