[acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosure
该报告还没有中文解读。
原文摘录
摘自原文（2973 字符中的一小部分）
I know that this domain https://acronis.secure.force.com is not listed in scope but I thought it would be a good idea to share this finding with you because this endpoint is leaking internal information/meetings.
原文中的代码
{"actions":[{"id":"123;a","descriptor":"serviceComponent://ui.force.components.controllers.lists.selectableListDataProvider.SelectableListDataProviderController/ACTION$getItems","callingDescriptor":"UNKNOWN","params":{"entityNameOrId":"Event","layoutType":"FULL","pageSize":100,"currentPage":0,"useTi …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Acronis 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @amsda · 版权归作者与 Acronis 所有