HexBrain

U.S. Dept Of Defense · Report #874017

SSN is exposed on slides, previous critical report was not fixed in an appropriate way

Validstatus
criticalseverity
9upvotes
11 Jun 2020disclosed

How it was found

Summary: SSN is exposed on slides, previous critical report was not fixed in an appropriate way

Description:

  1. SSN is exposed on a screenshot. Slide 13th. SSN is covered by an olive/green rectangle which is moveable. The image itself was not updated. ██████wp-content/uploads/2018/12/████████

  2. The issue was previously submitted and was not fixed in an appropriate way. https://hackerone.com/reports/█████████

  3. The file is easy to find by the file name. https://duckduckgo.com/?q=%22███%22&t=hj&ia=web

Impact

Critical ███████ is a real person (officer) according to ██████████

Step-by-step Reproduction Instructions

  1. Download the file ████████wp-content/uploads/2018/12/█████
  2. Navigate to slide 13
  3. Move the olive rectangle which covers SSN

Product, Version, and Configuration (If applicable)

N/A

Suggested Mitigation/Remediation Actions

Blur/remove/cover the SSN on the image and replace the image on the slides.

Impact

PII leakage. Name and SSN.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original