U.S. Dept Of Defense · Report #1632104
Sensitive information disclosure [HtUS]
Validstatus
highseverity
23upvotes
24 Feb 2023disclosed
How it was found
Summary:
Hi Team :) I found that the server status directory on your system is open, it displays server status and sensitive information by server
Steps To Reproduce:
[add details for how we can reproduce the issue]
- visit: https://█████████/server-status/
Supporting Material/References:
███
- [attachment / reference]
Impact
sensitive information is clearly displayed, that is, server status, attackers can find sensitive information from the server (server logs)