Editing Experian (section)

=== 2022 ===

In late 2022 a flaw was revealed in Experian's website which allowed access to individual credit reports without full authentication, simply by changing the last part of the URL being requested from "/acr/oow/" to "/acr/report."<ref>{{cite web |last1=Krebs |first1=Brian |author1-link=Brian Krebs |title=Identity Thieves Bypassed Experian Security to View Credit Reports |url=https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/ |website=Krebs on Security |date=10 January 2023 |access-date=16 November 2024}}</ref> The flaw was fixed in early 2023, but it was not known how much data had been stolen through this security weakness.<ref>{{cite web |title=A Guide to Building Secure Web Applications/Preventing Common Problems/Parameter Manipulation |url=https://www.cgisecurity.com/owasp/html/ch11s04.html |website=CGIsecurity |access-date=16 November 2024}}</ref>