HexBrain

Stellar.org · Report #376563

Admin panel of https://www.stellar.org/wp-admin/

N/Astatus
mediumseverity
3upvotes
23 Feb 2020disclosed

How it was found

https://www.stellar.org/wp-admin/ link has various operations which should not be accessible to an anonymous user.

As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password.

on the other side server information is easily available with version and operating system details.

Impact

https://www.stellar.org/wp-admin/

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original