200 http code in 403 forbidden directories on main Ubnt.com domain

Disclosed: 2017-04-19 14:08:00 By 4websecurity To ui
Unknown
Vulnerability Details
Hello, My investigations revealed that we have accesible directory in forbidden directory: http://www.ubnt.com/static/ - forbidden http://www.ubnt.com/static/cm/ - forbidden Here we have http://www.ubnt.com/static/cm/mode/ accesible and then /xm/l and /django/ foders POC: http://www.ubnt.com/static/cm/mode/ - 200 http code (accesible) http://www.ubnt.com/static/cm/mode/xml/ - 200 http code (accesible) http://www.ubnt.com/static/cm/mode/django/ - 200 http code (accesible) Now, i didn't looked up very close to this pages content, but for sure we are not supposed to acces them. Thank you. Kind Regards.
Actions
View on HackerOne
Report Stats
  • Report ID: 220150
  • State: Closed
  • Substate: resolved
  • Upvotes: 8
Share this report