HexBrain
Open on HackerOneSign in

Yoti · Report #738615

Vulnerability in (*www.yoti.com) - Leads to Leakage of admin usernames

Validstatus
mediumseverity
93upvotes
11 Dec 2020disclosed

Summary

Summary

An issue discovered in Yoti's marketing website (www.yoti.com) WordPress implementation. The vulnerability exposes admin usernames through WordPress API endpoints.

Steps to Reproduce

  1. Search Shodan using query org:yoti.com
  2. Access the identified IP: http://185.116.54.11
  3. Add the following parameters to access WordPress API endpoints:
    • /wp-json
    • /wp-json/wp/v2/users

Impact

The vulnerability exposes admin usernames through WordPress API endpoints

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original