XSS in New York Times Virtual Agent

Rohit Kapur of Aon’s Cyber Solutions recently discovered a vulnerability in The New York Times’ Virtual Agent. The identified vulnerability allowed an attacker to perform Cross-Site Scripting (XSS) attacks on help desk staff via the chat platform.

The vulnerability was disclosed to the New York Times on May 28th and was remediated within 45 minutes. Aon’s Cyber Solutions would like to thank The New York Times for working with us as part of our coordinated disclosure process to remediate this issue very quickly.

First Name: *

Last Name: *

Business Email: *

Business Phone:

Job Title: *

Company: *

Location: *

How may we help you?

Aon and other Aon group companies will use your personal information to contact you from time to time about other products, services and events that we feel may be of interest to you. All personal information is collected and used in accordance with our privacy statement.

Please click here if you do not wish to receive these communications.

Cyber security services offered by Stroz Friedberg Inc. and its affiliates. Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates. Aon UK Limited is authorised and regulated by the Financial Conduct Authority in respect of insurance distribution services. FP.AGRC.238.JJ The following products or services are not regulated by the Financial Conduct Authority:
• Cyber risk services provided by Aon UK Limited and its affiliates
• Cyber security services provided by Stroz Friedberg Limited and its affiliates.

Copyright 2021 Aon plc. All Rights Reserved.