server calendar and server status available to public

Disclosed: 2016-02-20 12:12:30 By bulla To gratipay
None
Vulnerability Details
It was found that a calendar containing information about various tasks to be performed by the server admin can be viewed by any user. link: http://inside.gratipay.com/appendices/calendar it reveals stuff link data of expiration of ssl certificate, lastpass accounts, etc further important entries that might entered in the future may contain critical data and hence access to this link should only be to concerned personnel Server status - server load, bandwidth, database connections, etc revealed via public link link: http://inside.gratipay.com/appendices/health This link reveals important information about the server load and other information and can aid an attacker for other atacks These links belong to the inside.fratiplay.com which says that t is for the internal employees only yet the domain is accessible publically. Access to this domain should be restricted to the internal employees only.
Actions
View on HackerOne
Report Stats
  • Report ID: 116621
  • State: Closed
  • Substate: informative
Share this report