U.S. Dept Of Defense · Report #992618
Improper Access Control - Generic on https://████
Validstatus
highseverity
11upvotes
2 Apr 2021disclosed
Summary
Title : Uncontrolled access to a sensitive U.S. Department of Defense dashboard. Weakness : Improper Access Control - Generic Severity : High Reported at : September 28, 2020 3:31am +0200
How it was found
Greetings, I found on one of your sub-domains some tickets that are not supposed to be readable by everyone, we even have the possibility to delete the tickets. Link : https://███/█████/latest https://█████/███████/all https://█████/███████ (DELETE HEADER METHOD)
Best regards, frenchvlad
Impact
a malicious person can delete tickets and see the progress of tickets in progress