HexBrain

U.S. Dept Of Defense · Report #1632104

Sensitive information disclosure [HtUS]

Validstatus
highseverity
23upvotes
24 Feb 2023disclosed

How it was found

Summary:

Hi Team :) I found that the server status directory on your system is open, it displays server status and sensitive information by server

Steps To Reproduce:

[add details for how we can reproduce the issue]

  1. visit: https://█████████/server-status/

Supporting Material/References:

███

  • [attachment / reference]

Impact

sensitive information is clearly displayed, that is, server status, attackers can find sensitive information from the server (server logs)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original