Attacker can access graphic representation of every query
该报告还没有中文解读。
原文摘录
摘自原文（2665 字符中的一小部分）
Vulnerability details On a dashboard, widgets can be added to show a graphic representation of a query. These queries come from datasources. When creating a widget, a query ID is given. This query ID can be changed in order to obtain the results of the dataset through a scheduled email. This leaks …
原文中的代码
POST /widgets.json HTTP/1.1
Host: h1-bugbounty.bime.io
...
{"title":"SUM(Dynamic Count) per ID","height":0,"position_x":0,"position_y":0,"width":0,"query_id":1052531,"tab_id":612224,"visualisation_type":"none","configuration":"<Properties><Config name=\"borderColor\" value=\"#787c82\"/><Config …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Bime 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @jobert · 版权归作者与 Bime 所有