Session retention is present which reveals the customer info

Disclosed: 2016-05-09 22:35:46 By blueberryinfosec To uber
Unknown
Vulnerability Details
Issue : Session retention is present at partner.uber.com which reveals all senstive data Steps to reproduce : 1)Login to partner.uber.com under any driver profile 2)navigate to summary page or any page e.g payment page 3)logout the application 4)press back button of the application application reveals the information Impact & real time scenario : How it affects drivers : Imagine a driver was logging in at uber in a public system and logsout the application,now another user whom wish to know about the driver,clicks on back button of the browser to reveal the info Technical info : session was not cleared which makes the application to reveal all sensitive info
Actions
View on HackerOne
Report Stats
  • Report ID: 125634
  • State: Closed
  • Substate: duplicate
  • Upvotes: 1
Share this report