Auction site eBay has performed an about-turn and fixed a potential damaging vulnerability affecting its website.
However, the company has only partially fixed the JavaScript flaw, revealed a few days ago, which could have put users at risk of downloading malware.
Today’s news comes after eBay had previously said it had no plans to perform any repairs on its site, despite the vulnerability first being revealed by security researchers CheckPoint back in December.
This could have given cybercriminals an easy way to target users, either by sending a link to a very attractive product that would link to a download for malware, or by executing phishing scams purporting to come from eBay itself, offering new deals or special items.
Following CheckPoint’s reveal of its findings earlier this week, eBay says it has implemented various security filters based on Check Point’s findings, noting that it took security “very seriously”, but had yet to identify any fraudulent activity stemming from this incident.
“While not fully patched, given that we allow active content on our marketplace, it’s important to understand that malicious content on our marketplace is extraordinarily uncommon, which we estimate to be less than two listings per million that use active content on the eBay marketplace,” eBay told the BBC.
“This vulnerability allows attackers to bypass eBay’s code validation and control the vulnerable code remotely to execute malicious Java script on targeted eBay users,” said Check Point research manager Oded Vanunu.
“If this flaw is left unpatched, eBay’s customers will continue to be exposed to potential phishing attacks and data theft.”
Are you a security pro? Try our quiz!
After relocating from California to Texas in 2020, Oracle's Larry Ellison now reveals plan to…
Share price hit after Meta admits heavy AI spending plans, after posting strong first quarter…
For third time Google delays phase-out of third-party Chrome cookies after pushback from industry and…
Elon Musk firm touts cheaper EV models, as profits slump over 50 percent in the…
Bad news for Tim Cook, as Counterpoint records 19 percent fall in iPhone sales in…
TikTok pledges to challenge 'unconstitutional' US ban in the courts, after President Joe Biden signs…