Yahoo addressed a critical cross-site scripting (XSS) vulnerability in Yahoo Mail that could have been exploited by hackers to steal
The flaw was discovered by Jouko Pynnönen, it could have exploited by a threat actor to forward the victim’s emails to an external website, change the compromised Yahoo account’s settings, and perform other malicious activities. The flaw was tied with the lack of proper filtering for malicious code in HTML emails.
Pynnönen discovered the stored XSS flaw in Yahoo Mail in early December 2018 and the company fixed it in January. Pynnönen was awarded $10,000 for this bug.
The researcher did not disclose technical details of the vulnerability because Oath, the company that owns Yahoo, has asked him to keep his findings public.
Pynnönen only explained that the exploit is related to basic HTML filtering.
One year later, Pynnönen discovered another stored XSS vulnerability in the same Mail service that could have allowed hackers to read anyone messages.
The flaw was a DOM-based persistent Cross-Site Scripting in Yahoo mail, an attacker could have exploited it to send emails embedded with malicious code. The Finnish researcher also earned $10,000
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.