地图 / Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)

Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)

业务逻辑 / Client-Side Enforcement of Server-Side Security / #1406495

厂商: Shopify
严重程度: 低危 · CVSS 3.7
赏金: $900
弱点: Client-Side Enforcement of Server-Side Security
研究员: @saurabhsankhwar3
披露日期: 2022-02-15
资产: accounts.shopify.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（2125 字符中的一小部分）

I Found a Bug in which Hacker Have Ability to Disable the Login Attempt of any Shopify Owner With (Zero_Click)

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

2021-11-21报告提交
2022-02-15公开披露

阅读 HackerOne 原文 ↗作者 @saurabhsankhwar3 · 版权归作者与 Shopify 所有

同类报告

Incorrect control of the trial periodNord Security · —Information disclosure by sending a GIFLinkedIn · 2023-04-28 Yelp for Business: locked Email field silently editable via APIYelp · 2026-07-02 Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer SubmissionNintendo · 2026-07-02 Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permissionShopify · 2019-10-10 Augur UI data can be completely replaced by an attacker which can lead to fund and reputation lossAugur · — · $5,000