Can anyone confirm, was it possible for someone to view data of a specific, chosen account or were people just being logged into random accounts.
In other words, could an attacker exploit this bug to "dox" a specific target?
In other words, could an attacker exploit this bug to "dox" a specific target?
Possible explanation from unknown source: https://www.reddit.com/r/Steam/comments/3y7le9/im_logged_in_...
An attacker could send you a URL with a random query parameter, which would be ignored by Steam. But the response would be cached- with that query parameter. The attacker could then visit the URL themselves, and see private information.
An attacker could also grab CSRF tokens from the page, and perform certain actions on a victim's account.