A new vulnerability discovered in LinkedIn AutoFill functionality leaks users sensitive information to 3rd party websites.
LinkedIn provides an AutoFill a future for other websites to fill information such as LinkedIn user’s name, email address, phone number, location, and job.
This Linkedin provides only for paying customers of LinkedIn’s Marketing Solutions increases the volume and quality of conversions.
Customer domains must be whitelisted for LinkedIn AutoFill to function properly, but this vulnerability could abuse this restriction and leaks the sensitive information.
This Vulnerability allowed an attacker to steal your full name, phone number, email address, ZIP code, company and job title.
In this case, If any of those sites have cross-site scripting vulnerabilities, which Cable confirmed some do, hackers can still run AutoFill on their sites by installing an iframe to the vulnerable whitelisted site,Techcrunch says.
Exposed LinkedIn Flaw working in the following ways,
postMessage
to the malicious site.According to researcher Jack Cable , “It seems like LinkedIn accepts the risk of whitelisted websites (and it is a part of their business model), yet this is a major security concern,”
This leads , a compromise in any of the whitelisted websites would have exposed the information of LinkedIn users to malicious hackers.
He discovered the issue on April 9th, 2018 and immediately disclosed it to LinkedIn. The company issued a fix on April 10th but didn’t inform the public of the issue.
GitLab has announced the release of critical security updates for its Community Edition (CE) and…
Multiple Xerox printer models, including EC80xx, AltaLink, VersaLink, and WorkCentre, have been identified as vulnerable…
Cisco has issued a critical security advisory regarding a vulnerability in its Adaptive Security Appliance…
Google has released several security patches for its Chrome browser, addressing critical vulnerabilities that malicious…
Grayscale Investments, a prominent crypto asset manager, has reportedly suffered a data breach affecting 693,635…
A database containing over 1,000 email accounts associated with the National Health Service (NHS) has…