地图 / Without verifying email and activate account, user can perform all action which are not supposed to be done

Without verifying email and activate account, user can perform all action which are not supposed to be done

错误配置 / 违反安全设计原则（按标题归类） / #1272305

厂商: Stripe
严重程度: 低危
赏金: —
弱点: 违反安全设计原则（按标题归类）
研究员: @tabaahi
披露日期: 2022-07-18
资产: *.stripe.com
CVE: —

该报告还没有中文解读。

时间线

2021-07-21报告提交
2022-07-18公开披露

阅读 HackerOne 原文 ↗作者 @tabaahi · 版权归作者与 Stripe 所有

同类报告

Bruteforce password recovery codeBumble · 2020-01-18 Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsHackerOne · 2024-02-04 · $3,750 Hacker.One Subdomain TakeoverHackerOne · 2016-09-20 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPHackerOne · 2017-08-29 Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageSemrush · 2020-01-10 [Critical] Delete any accountOLX · —