POJIA破甲
地图 / URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.io

URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.io

跨站请求伪造 / 跨站请求伪造 / #49663

厂商
Vimeo
严重程度
未评级
赏金
—
弱点
跨站请求伪造
研究员
@avlidienbrunn
披露日期
2015-04-18
资产
—
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1038 字符中的一小部分)
**Brief** This is an urgent issue and I hope you will act on it likewise. Your subdomain status.vimeo.com is pointing to hosted.statuspage.io, but no statuspage was connected to it. This means that anyone can claim the subdomain by setting up a statuspage.io site and using "status.vimeo.com" as the …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Vimeo 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @avlidienbrunn · 版权归作者与 Vimeo 所有

同类报告

[CSRF] TikTok Careers Portal Account TakeoverTikTok · 2020-12-15CSRF on connecting Paypal as Payment ProviderShopify · 2020-04-10Account Takeover using Linked Accounts due to lack of CSRF protectionRockstar Games · 2019-02-20Periscope android app deeplink leads to CSRF in follow actionX / xAI · 2020-02-21 · $1,540Take over of accounts created using Google or FacebookKhan Academy · 2019-05-17Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneHackerOne · 2023-06-19