U.S. Dept Of Defense · Report #1624374
Broken access discloses users and PII at https://███████ [HtUS]
Validstatus
highseverity
8upvotes
14 Oct 2022disclosed
How it was found
Good morning,
I was able to register at https://████/ and get the list of users. 1- Go to https://██████████/OA_HTML/ibeCAcpSSOReg.jsp and register. 2- Go to https://███/OA_HTML/AppsLocalLogin.jsp with the created user and login. 3- On the homepage, click on vacations rules, create, and search users. 4- User are disclosed.
██████
Regards,
G4MB4
Impact
An attacker is able to access users information.