Yelp · Report #361984
I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)
Validstatus
mediumseverity
32upvotes
19 Aug 2020disclosed
Summary
@hk755a discovered an Insecure Direct Object Reference Vulnerability that allowed an attacker to obtain the last four digits of a credit card that has been registered with the Yelp platform, through the error messages that the /profile_payment/save endpoint returned.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.