Legal Robot · Report #180548
Missing restriction on string size in profile fields
Validstatus
mediumseverity
9upvotes
20 Jan 2017disclosed
Summary
Security researcher reported that there was no restriction on the amount of text that could be inserted into a user's profile field. The researcher also demonstrated that when the text size was large enough the service was restarted, resulting in a momentary outage in our non-production environment (not high-availability). An internal reproduction showed isolated disruption but no outage in our production environment.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.