csharpfritz / csharpfritz/CoreWiki
[Security] Require password or 2FA verification for account changes
Open
- Dominant language
- CSS
- Stars
- 438
- Forks
- 159
- PR merge metrics
- No merged PRs in 30d
Description
If the site is vulnerable to XSS an attacker could change profile information for a user without their interaction. An attacker could leave a comment on the home page that changes the users e-mail address, requests a password reset, and then changes the users e-mail address back to what it was. All without them knowing.
```html
```
Before:
After:
Contributor guide
Assessment
This issue has not been assessed yet.