LinkedIn

LinkedIn 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 不安全的直接对象引用12
• 访问控制10
• 其他弱点6
• 业务逻辑4
• 身份认证4
• 信息泄露3
• 跨站请求伪造2
• 错误配置1
• 代码执行1
• 跨站脚本1

主要弱点

• IDOR12
• 访问控制缺陷（通用）8
• Unlabeled5
• 信息泄露3
• 业务逻辑错误2
• 认证缺陷（通用）2
• 权限提升2
• 跨站请求伪造2
• Unlabeled1
• Client-Side Enforcement of Server-Side Security1

常见资产

• www.linkedin.comURL · 39
• · 3
• com.linkedin.androidGOOGLE_PLAY_APP_ID · 2

高票报告

当前状态 44 份 · 全部 44

1. 53
   CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*跨站请求伪造 · 2023-12-07 · 中危
   $0跨站请求伪造
2. 48
   IDOR - Delete technical skill assessment result & Gained Badges result of any user其他弱点 · 2022-10-06 · 中危
   $0Unlabeled
3. 48
   Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]访问控制 · 2022-08-27 · 中危
   $0权限提升
4. 44
   Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning`不安全的直接对象引用 · 2023-05-12 · 中危
   $0IDOR
5. 43
   Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed不安全的直接对象引用 · 2023-05-17 · 中危
   $0IDOR
6. 41
   CSRF that makes any user send invitations to the attacker by simply clicking on a link.跨站请求伪造 · 2023-12-07 · 中危
   $0跨站请求伪造
7. 41
   bypass two-factor authentication.身份认证 · 2023-08-01 · 中危
   $0认证缺陷（通用）
8. 41
   Delete any LinkedIn comment on learning API of other users访问控制 · 2023-05-12 · 中危
   $0访问控制缺陷（通用）
9. 34
   Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id}访问控制 · 2023-10-19 · 中危
   $0访问控制缺陷（通用）
10. 34
    An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report]业务逻辑 · 2023-08-24 · 中危
    $0业务逻辑错误
11. 32
    HTML injection at Company Name or Product Name and can be shown on Contact Sales form其他弱点 · 2023-10-18 · 低危
    $0Unlabeled
12. 30
    Ad Account Takeover访问控制 · 2023-07-21 · 严重
    $0权限提升
13. 28
    “See who’s interested in working for your company” - security issue信息泄露 · 2023-06-21 · 中危
    $0信息泄露
14. 23
    [ Continuation Report from #1814842 ] Can create articles using other users' NewsLetters不安全的直接对象引用 · 2023-05-15 · 中危
    $0IDOR
15. 21
    Campaign Account Balance and History Disclosed in API Response不安全的直接对象引用 · 2022-12-01 · 中危
    $0IDOR
16. 20
    Attacker can unpin posts from companies he's not part of.其他弱点 · 2023-05-12 · 低危
    $0Unlabeled
17. 8
    Add me email address Authentication bypass身份认证 · 2022-07-16 · 未评级
    $0Unlabeled
18. 7
    Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)业务逻辑 · 2022-06-16 · 未评级
    $0Unlabeled
19. 3
    The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su身份认证 · 2022-06-16 · 中危
    $0认证尝试次数未限制