Ubiquiti Inc. · Report #116504
Auth bypass on directory.corp.ubnt.com
Validstatus
5upvotes
2 Jun 2016disclosed
Summary
The researcher (ebrietas) demonstrated that access to our Internal corporate directory could be gained due to a misconfiguration in Google OpenID. This involved using a non-UBNT Google account and modification to the URL.
The issue was resolved and the researcher was awarded a bounty for his responsible disclosure.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.