Starbucks · Report #844067
Korea - LFI Server directory traversal at starbucks.co.kr
Validstatus
highseverity
16upvotes
30 Apr 2020disclosed
Summary
b4bilal discovered a misconfiguration when handling URI paths. This permitted an adversary to traverse the docroot and access non sensitive resources that are normally unavailable to web users. @b4bilal — thank you for reporting this vulnerability and for confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.