JVN#77886599

Hatena Toolbar sends URL information unecnrypted

Overview

Hatena Toolbar improperly sends URL information to the Hatena server without being encrypted when a user views a web page secured by SSL.

Products Affected

• Hatena Toolbar v1.5.4 and earlier

Description

Impact

When a user of Hatena Toolbar views a SSL secured web page, an attacker could obtain the information contained in the URL such as a session ID which needs to be protected. As a result, an attacker could possibly conduct session hijacking.

Solution

Vendor Status

References

JPCERT/CC Addendum

Credit

Hiromitsu Takagi reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

Update History