News for hackers. Stuff that matters.

A comment on Security advisory: Breach and Django. Parent comment

Re:Security advisory: Breach and Django by antihero on Tuesday August 06, 2013 @11:31AM (#6167112)
Could you clarify what actually can be done by this? From what I can see, you can't do XSS because it's escaped.

I guess there's the chance that you could do CSRF because you've essentially "set" their CSRF token?

[ Parent | on HN ]
Re:Security advisory: Breach and Django by homakov on Tuesday August 06, 2013 @11:35AM (#6167140)
XSS? unrelated here I think.

Exactly, cookie forcing/tossing = "set" their CSRF token

[ Parent | on HN ]