Uber · Report #326080
Improper Access Control on Onelogin in multi-layered architecture
Validstatus
$500bounty
29upvotes
8 Aug 2018disclosed
Summary
Path traversal in the web server powering uberinternal.com allowed an attacker to view content hosted on these subdomains, bypassing OneLogin authentication.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.