Social networking sites Pinterest and StumbleUpon have patched vulnerabilities in their services that allowed attackers to discover user's personal information.
The flaws were found by security researcher Dan Melamed who detailed how a simple exploit could be run to potentially build a large email list for phishing attacks.
The Pinterest flaw worked by replacing a URL string with a username that returned a web page with a target’s email address.
"This flaw works with any user on Pinterest," Melamed said on a blog. "It works with either a username or a user ID. And it works with any access token."
StumbleUpon had patched a similar flaw in its service that exposed names, email address, location, age and gender, he said.
The disclosure follows widespread cracking of Pinterest accounts and an uptick in phishing scams targeting the network.
_(22).jpg&h=140&w=231&c=1&s=0)
.png&h=140&w=231&c=1&s=0){kind=logo}
_(28).jpg&h=140&w=231&c=1&s=0)
_(26).jpg&w=100&c=1&s=0)
iTnews Executive Retreat - Security Leaders Edition
_(1).jpg&h=140&w=231&c=1&s=0)
