HexBrain

HackerOne · Report #313075

Information Disclosure which violate program privacy

Informativestatus
lowseverity
5upvotes
20 Feb 2018disclosed

How it was found

Summary: please refer to the following report: https://hackerone.com/reports/311289

It was noticed that TTS changed the summary and set the domain to example.gov as not to reveal to the public. But at the bottom of the page, "britta changed the scope from https://ci.fr.cloud.gov to None."

Recommendation: Should only provide general message for such situation: "britta changed the scope"

Impact

not much of impact. but violate Confidentiality of the program.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original