微软Titan分析平台JWT签名未校验漏洞

1. 05:10
   TechRadar · AI

   16岁漏洞猎人Faav借未校验签名获微软Titan管理员权限

   16岁漏洞猎人Faav利用微软内部Titan分析服务未校验JWT签名，以字符串admin获得管理员权限，可触及约17.3万亿行数据和约25000个账户元数据。微软已修复漏洞并支付5000美元赏金，称该数字为理论存储估计而非实际泄露的客户信息。

Current heat 9·Comparable peak 10（Oct 6）·Comparable change over 24 hours –

The trend compares only the same participants observed continuously; its range may be smaller than the current heat count. Move or click on the chart to inspect hourly heat; use the left and right arrow keys to switch.