Udemy · Report #172707
Udemy s3 storage can be used by an attacker personal website because of missing CSRF Token
Informativestatus
1upvotes
5 Jan 2017disclosed
Summary
The report was about a staging S3 bucket where we allow any file to be uploaded and then further process it from there. It was closed as informative because there is no security risk associated with it.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.