Information Exposure Through an Error Message at news.starbucks.com

How it was found

I've discovered Information Exposure Through an Error Message on your system POC link:

https://news.starbucks.com/cms/index.php?/cp/login/forgotten_password_form=http://evil.com/?id=test-test

Vulnerable url --> https://news.starbucks.com/cms/index.php?/cp/login/forgotten_password_form=http://evil.com/?id=test-test

Proof screenshot attached.

Impact

Impact references:

https://cwe.mitre.org/data/definitions/209.html

Best regards