地图 / An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.

An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.

不安全的直接对象引用 / IDOR / #2291999

厂商: LinkedIn
严重程度: 中危 · CVSS 8.2
赏金: —
弱点: IDOR
研究员: @marvelmaniac
披露日期: 2024-03-12
资产: www.linkedin.com
CVE: —

该报告还没有中文解读。

时间线

2023-12-19报告提交
2024-03-12公开披露

阅读 HackerOne 原文 ↗作者 @marvelmaniac · 版权归作者与 LinkedIn 所有

同类报告

Delete anyone's content spotlight remotely.Snapchat · 2023-03-06 · $15,000 IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersPayPal · 2019-07-30 · $10,500 How the Bug stole hackingHackerOne · 2019-12-20 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryHackerOne · 2023-08-29 IDOR allow access to payments data of any userNord Security · —IDOR allows user to access report details via reference.json endpointHackerOne · 2026-10-01 · $15,000

An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users. · 破甲 POJIA