Partial disclosure of report activity through new "Export as .zip" feature

Disclosed: 2016-11-29 01:51:51 By faisalahmed To security
High
Vulnerability Details
Hello Team, I noticed a new feature has been launched, which allows to export report. Great feature. But unfortunately it discloses comments of partially disclosed reports which supposed to be hidden.. ###POC: * Go to this partially disclosed report > https://hackerone.com/reports/██████████ * Click **Export** Button. * You'll see comments are getting disclosed! {F134909} This way you can see all the partially disclosed reports comments. Please let me know if you need more information! Looking forward!
Actions
View on HackerOne
Report Stats
  • Report ID: 182358
  • State: Closed
  • Substate: resolved
  • Upvotes: 341
Share this report