critical server misconfiguration lead to access to any user sensitive data which include user email and password
该报告还没有中文解读。
原文摘录
摘自原文（4272 字符中的一小部分）
Hi flickr team, I found a critical issue lead to access to any user sensitive data which include user hashed password and possibly can lead to takeover any user account on flickr's main site, literally i can get all user information from database with no restrictions , Let me explain how this …
原文中的代码
Y.listData = {
"user": {
"id": "█████",
"first_name": "███████",
"last_name": "████",
"email": "███",
"date_creation": "█████",
"date_modified": "0",
"password": "██████",
"city": "los angelos",
"country": "United states",
"check_code": "", …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Flickr 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @mr_robert · 版权归作者与 Flickr 所有