Sensitive Information Leaking Through DARPA Website. [█████████]
Medium
Vulnerability Details
**Summary:**
While performing recon work on websites owned by DoD i came up with DARPA website which is leaking sensitive information.
**Description:**
The above website is leaking information such as- first name and last name, email address, phone number, house address and organization name of attendees in a clear readable pdf document. This is a high severity issue and requires immediate fixation. It is also a clear privacy violation and insufficient protection mechanism involved in data storage. I look forward for a satisfactory reply from your side.
## Step-by-step Reproduction Instructions
1. Open a web browser of your choice.
2. Now open this URL: https://███/attachments/███████
## Suggested Mitigation/Remediation Actions
Remove document from the internet or put applicable authorization mechanism(s) in order to access sensitive documents.
## Impact
Any person can access this document and cause information leakage, target specific person for crime.
Actions
View on HackerOneReport Stats
- Report ID: 805027
- State: Closed
- Substate: resolved
- Upvotes: 3