Web Application Security Consortium - Web hacking Incidents Database (WHID)

Contributors

Jeremiah Grossman
(WhiteHat Security)

Ofer Shezaf
(Breach Security ) [Project Leader]

The Web Hacking Incidents Database
Last update:07 November 2007

Incident WHID 2005-61

Full List
By Class
By ID

1999
2000
2001
2002
2003
2004
2005
2006
2007

RSS
Statistics
Blog
FAQ
About

WHID

WHID 2005-61: Gmail session management bug

Date: 18 October 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction

A bug in Gmail's authentication and session management allows direct login to anybodies account without requiring any involvement of the victim.

References:

Gmail bug [elhacker.net]

Google Downplays Gmail Security Fix [eWeek]

This work is licensed under the Creative Commons Attribution License. To view a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.