Web vulnerability exposes shared links in Dropbox

Share this article:

A web vulnerability, which the company says has been addressed, can cause Dropbox users to inadvertently share links to sensitive documents and information, according to a blog penned by Dropbox Vice President of Engineering Aditya Agarwal.

When a Dropbox user shares a link to a document that includes a hyperlink to a third-party website and the recipient clinks on the hyperlink, a referer header reveals the original shared link to the third-party site.

“Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document,” Agarwal wrote.

Dropbox hasn't found any instances of the vulnerability being exploited but has disabled access entirely for the time being and has patched the vulnerability. Dropbox for Business users, who have the ability to restrict shared link access, are not affected.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Adobe exploit used to spread Dyre credential stealer

Adobe exploit used to spread Dyre credential stealer

Users running vulnerable Adobe software could be in danger of having credentials for Bitcoin websites stolen.

Staples is investigating a potential issue involving credit card data

Staples is investigating a potential issue involving credit ...

The company said it is investigating a potential issue involving credit card data and that customers are not responsible for fraudulent activity on cards if an issue is discovered.

Skills set a priority over legacy prejudices, experts say

Skills set a priority over legacy prejudices, experts ...

Cybersecurity expert Winn Schwartau and Robert Clark, a cyber law attorney at the Army Cyber Institute, discussed issues around hiring in the information security industry.