Re:Google's login page accepts a vulnerable GET parameter
by polemic on Tuesday August 30, 2016 @10:43PM
(#12395626)
> "If AB is a vulnerability only if B is a vulnerability, then A is not a vulnerability"
Stringing together multiple (seemingly) insignificant vulnerabilities to pivot through a system or own a user is hacking 101. I'm not sure how you'd fix this, but given Google's prevalence as an authentication provider, it's definitely not worth being glib about.
Stringing together multiple (seemingly) insignificant vulnerabilities to pivot through a system or own a user is hacking 101. I'm not sure how you'd fix this, but given Google's prevalence as an authentication provider, it's definitely not worth being glib about.