Mavenlink · Report #299334
Information disclosure when trying to delete an expense's attachment on m.mavenlink.com
Validstatus
mediumseverity
17upvotes
20 Jan 2018disclosed
Summary
There was an information disclosure vulnerability in a particular error message on the mobile site. Using this vulnerability, it was possible to gain access to the filename of certain un-owned attachments.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.