Please sign in to comment.
Fix h1 report 148745
Reflected file download ----------------------- Abdullah Hussam has reported via HackerOne that www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain. CWE: CWE-79 CVSSv2: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVSSv3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C CVSSv3 Base Score: 9.6 CVSSv3 Temporal Score: 8.9
- Loading branch information...