Sifchain · Report #1188662

Username disclosure at Main Domain

Duplicatestatus

lowseverity

1upvotes

9 Dec 2021disclosed

How it was found

Hello,

PoC Link

https://sifchain.finance//wp-json/wp/v2/users/

thanks.

Impact

Malicious counterpart could collect the usernames disclosed (and the admin user) and be focused throughout BF attack (as the usernames are now known), making it less harder to penetrate the data.gov systems.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original