Ubiquiti Inc. · Report #219014
[dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies
Validstatus
mediumseverity
12upvotes
28 Aug 2017disclosed
Summary
Due to a development designed error page and insecure CORS Header in dev-unifi-go.ubnt.com, the researcher was able to demonstrate how an attacker could steal users cookies by luring the user to access a web page controlled by the attacker.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.