HexBrain

HackerOne · Report #263

Report title autocompletion

Validstatus
8upvotes
8 Jun 2015disclosed

How it was found

Scenario:

  1. Researcher uses a shared computer.
  2. Researcher submits a report.
  3. Researcher logs out.
  4. Another person logs in, on another account.
  5. Another person submits a report.
  6. When entering a title, the title of the previous report submitted by the researcher is shown in autocompletion box.

This gives away the title of the bug to other users of the web browser, even though the researcher logged out properly.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original