地图 / Account Take over of millions of MTN users account due to lack of Rate limiting when sending OTP code

Account Take over of millions of MTN users account due to lack of Rate limiting when sending OTP code

身份认证 / 认证缺陷（通用） / #761000

厂商: MTN Group
严重程度: 中危
赏金: —
弱点: 认证缺陷（通用）
研究员: @its_afolic
披露日期: 2020-04-13
资产: mtn.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（212 字符中的一小部分）

I attached a PDF document to this report which explained the vulnerability in full details and I also attached a link to the POC video in the document.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 MTN Group 所有。

时间线

2019-12-18报告提交
2020-04-13公开披露

阅读 HackerOne 原文 ↗作者 @its_afolic · 版权归作者与 MTN Group 所有

同类报告

Improper Authentication - any user can login as other user with otp/logout & otp/loginSnapchat · 2021-09-03 Bypassing Digits origin validation which leads to account takeoverX / xAI · 2020-06-24 Flickr Account Takeover using AWS Cognito APIFlickr · 2021-12-18 Chained Bugs to Leak Victim's Uber's FB Oauth TokenUber · 2019-01-25 [cs.money] Open Redirect Leads to Account TakeoverCS Money · 2020-09-30 OTP token bypass in accessing user settingsRazer · — · $1,000