Louis Vuitton fixes data leak and account takeover vulnerability

guest · Sep 25, 2020

Louis Vuitton fixes data leak and account takeover vulnerability
September 25, 2020
https://www.bleepingcomputer.com/ne...data-leak-and-account-takeover-vulnerability/

Louis Vuitton has quietly patched a security vulnerability on its website that allowed for user account enumeration and even allowed account takeover via password resets.
Founded in 1854, Louis Vuitton is a prominent luxury French fashion brand and merchandise company with over 121,000 employees and a $15 billion annual revenue.

The easily exploitable flaw resided within the MyLV account section of the website.
An attacker can potentially obtain email addresses of multiple Louis Vuitton's members without their knowledge or consent by simply enumerating their account ID in the URL.
Click to expand...

Account takeover via enumeration
Another worrisome aspect of My LV account website is how it enabled anyone to takeover a Louis Vuitton member's account.

Consider that a user had previously shopped on the website using their email address, but hadn't signed up for an account.
Louis Vuitton fixes flaw, thanks researcher
Today, Louis Vuitton has patched the flaw and as observed by BleepingComputer, the website no longer leaks arbitrary email addresses or allows account takeovers when navigating to the account creation URL in question.
Click to expand...

Log in or Sign up

Louis Vuitton fixes data leak and account takeover vulnerability

guest Guest

Log in or Sign up

Louis Vuitton fixes data leak and account takeover vulnerability

guest Guest

Useful Searches