HackerOne · Report #263
Report title autocompletion
Validstatus
8upvotes
8 Jun 2015disclosed
How it was found
Scenario:
- Researcher uses a shared computer.
- Researcher submits a report.
- Researcher logs out.
- Another person logs in, on another account.
- Another person submits a report.
- When entering a title, the title of the previous report submitted by the researcher is shown in autocompletion box.
This gives away the title of the bug to other users of the web browser, even though the researcher logged out properly.