Gratipay · Report #136720

don't leak server version of grtp.co in error pages

Validstatus

lowseverity

1upvotes

14 Jul 2016disclosed

How it was found

Open the latest Firefox web browser or google chrome.

Navigate to the following URL: https://grtp.co/%pa

Note that the Invalid URL Encoded (%pa) has fired. after execution,It gives 404 error with server information and its version.

I’ve tested this in the latest Firefox and Chrome.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original