地图 / Information disclosure by sending a GIF

Information disclosure by sending a GIF

业务逻辑 / Client-Side Enforcement of Server-Side Security / #1801427

厂商: LinkedIn
严重程度: 低危 · CVSS 4.3
赏金: —
弱点: Client-Side Enforcement of Server-Side Security
研究员: @qualw1n
披露日期: 2023-04-28
资产: www.linkedin.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1614 字符中的一小部分）

Summary - The attacker can view the Operating System, Version Of The Operating System, Browser, IP Address, Device ID, Phone Model, Time Zone and other critical information about any LinkedIn user they have identified as a victim.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 LinkedIn 所有。

时间线

2022-12-12报告提交
2023-04-28公开披露

阅读 HackerOne 原文 ↗作者 @qualw1n · 版权归作者与 LinkedIn 所有

同类报告

Incorrect control of the trial periodNord Security · —Yelp for Business: locked Email field silently editable via APIYelp · 2026-07-02 Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)Shopify · 2022-02-15 · $900 Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer SubmissionNintendo · 2026-07-02 Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permissionShopify · 2019-10-10 Augur UI data can be completely replaced by an attacker which can lead to fund and reputation lossAugur · — · $5,000