地图 / Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

错误配置 / Unlabeled / #796956

厂商: Shopify
严重程度: 低危 · CVSS 6.8
赏金: —
弱点: Unlabeled
研究员: @ngalog
披露日期: 2020-04-01
资产: your-store.myshopify.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（3386 字符中的一小部分）

Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

2020-02-14报告提交
2020-04-01公开披露

阅读 HackerOne 原文 ↗作者 @ngalog · 版权归作者与 Shopify 所有

同类报告

[www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive informationEternal · 2018-11-28 · $550 Hackerone supports accounts organitation takeoverHackerOne · 2024-11-19 · $2,500 Subdomain takeover of resources.hackerone.comHackerOne · 2020-05-15 · $500 CORS misconfiguration allows to steal client's "password", Authorization token and the customer details e.g. names, SSN, bank account etc.LocalTapiola · —Clickjacking in main domain https://topechelon.com/Top Echelon Software · 2025-02-10 Subdomain takeover dew to missconfigured project settings for Custom domain .Flock · —