HexBrain

Kaspersky · Report #1195618

No Rate Limit On Forgot Password Page

Validstatus
lowseverity
27upvotes
24 May 2021disclosed

Summary

Reported security issue allowed a potential attacker to abuse the password recovery option on our My Kaspersky portal for mass sending of password recovery messages. This was fixed with a password reset throttling feature to protect our service from its abuse by third parties. Note that this problem is related to our internal services and doesn't require any actions from side of our users.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original