Web vulnerability exposes shared links in Dropbox

Share this article:

A web vulnerability, which the company says has been addressed, can cause Dropbox users to inadvertently share links to sensitive documents and information, according to a blog penned by Dropbox Vice President of Engineering Aditya Agarwal.

When a Dropbox user shares a link to a document that includes a hyperlink to a third-party website and the recipient clinks on the hyperlink, a referer header reveals the original shared link to the third-party site.

“Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document,” Agarwal wrote.

Dropbox hasn't found any instances of the vulnerability being exploited but has disabled access entirely for the time being and has patched the vulnerability. Dropbox for Business users, who have the ability to restrict shared link access, are not affected.

Share this article:

Sign up to our newsletters

More in News

Incapsula mitigates multi-vector DDoS attack lasting longer than a month

Incapsula mitigates multi-vector DDoS attack lasting longer than ...

Incapsula's scrubbing servers were able to filter out more than 50 petabits of malicious DDoS traffic aimed at a video game company for longer than a month.

UPS announces breach impacting 51 U.S. locations

The shipping and printing provider said malware has been present on some stores' computer systems since mid-January.

'Machete' espionage campaign targets orgs in Venezuela, Ecuador

The campaign targets Spanish speaking victims, which also appears to be the native language of attackers.