Forgoten Dynasty, on 01 December 2011 - 01:08 AM, said:
More like a month. 3.2 - 3.2.2 all had a very severe xss flaw which would allow an attacker to perform any front end action including all moderator actions. The only thing which actually remains secure is the acp and that said your only protection stopping an attacker from getting your plain text password is the browser being smart enough to not auto fill credentials.
That said in a disaster scenario where the administrator was using an outdated browser which was exploitable to some kind of auto complete xss (safari seems to have a bad track record for this) then plain text passwords could be extracted.
The acp link could be extracted given that there was a link visible to administrators.
and any .htaccess can be bypassed.
That said in a disaster scenario where the administrator was using an outdated browser which was exploitable to some kind of auto complete xss (safari seems to have a bad track record for this) then plain text passwords could be extracted.
The acp link could be extracted given that there was a link visible to administrators.
and any .htaccess can be bypassed.
Could you give me a link to this? I wasn't able to find any mention of it in the announcements forum or tracker, and hotfixes are usually released for any significant security issues.
Also, how would a properly formed htaccess be bypassable?



Find content
Male


