Search the Community

Login page XSS, though, not content. No commenter IDs compromised ... The Guardian has fixed a minor cross-site scripting vulnerability on its website. The flaw, discovered and responsibly disclosed by security researcher Pete Houghton, occurred at the worse possible place on the UK broadsheet's website - right on its login page. Readers use the page to log in and comment on stories. In theory the flaw might have been used to phish the login credentials of Guardian readers. There's no evidence this actually happened. A Guardian News & Media spokesperson told El Reg: "We have not asked our users to change their passwords as there is no evidence that this flaw was exploited maliciously". Houghton notified the UK broadsheet about the flaw in early April and it was fixed by early June. Houghton only published a detailed write-up of the problem last week, however. The bug hunter praised The Guardian's team's overall handling of his bug report. Cross-site scripting (XSS) vulnerabilities stem from web application development mistakes. Attackers can exploit XSS bugs to inject scripts or pop-ups from untrusted sites so that they appear to surfers as originating from the site they happened to be visiting. XSS flaws are a common class of vulnerability, most regularly abused in phishing attacks. XSS bugs are bad news whenever they appear but the practical danger they pose is only really worth worrying about when they appear on banking or e-commerce websites. More on the consequences of XSS problems can be found in a guide by the Open Web Application Security Project? here. ® Via: The Grauniad corrects an error on its website • The Register