Skip to content

Commit 050cd23

Browse files
authored
Update README.md
Fixed the grammatical error pointed out @dwiley258 Signed-off-by: Hubert Daniszewski <[email protected]>
1 parent 8541336 commit 050cd23

File tree

1 file changed

+1
-1
lines changed
  • docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-209

1 file changed

+1
-1
lines changed

docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-209/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Purposefully triggered errors can help an attacker to find out system details, s
1414
* How to correctly format requests and use an internal API
1515
* Other sensitive information such as keys or passwords.
1616

17-
Sensitive data can be leaked on both ends of the client-server architecture. Not only can the attackers can gather sensitive information from vulnerable web servers, but they can do so from victims who use vulnerable web browsers as well. Cases of such vulnerabilities have been described in [CVE-2013-0773](https://www.cvedetails.com/cve/CVE-2013-0773/) or [CVE-2021-43536](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43536).
17+
Sensitive data can be leaked on both ends of the client-server architecture. Not only can the attackers gather sensitive information from vulnerable web servers, but they can do so from victims who use vulnerable web browsers as well. Cases of such vulnerabilities have been described in [CVE-2013-0773](https://www.cvedetails.com/cve/CVE-2013-0773/) or [CVE-2021-43536](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43536).
1818

1919
Aside from a direct attack on a clients browser cache, it also must be assumed that any URL visited by an authorized user may become available to an unauthorized party. HTTP_REFERER is a HTTP header containing the previous visited URL. It can become available to any untrusted entity without an active attack. This header could potentially be used to leak a URL that would allow the attacker to reset the password to the victim's account, as described in [[Mozilla Developers 2025](https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns)].
2020

0 commit comments

Comments
 (0)