Sensitive Information Leaking Through DARPA Website. [█████████]

Disclosed: 2020-05-14 17:58:05 By rootuser To deptofdefense
Medium
Vulnerability Details
**Summary:** While performing recon work on websites owned by DoD i came up with DARPA website which is leaking sensitive information. **Description:** The above website is leaking information such as- first name and last name, email address, phone number, house address and organization name of attendees in a clear readable pdf document. This is a high severity issue and requires immediate fixation. It is also a clear privacy violation and insufficient protection mechanism involved in data storage. I look forward for a satisfactory reply from your side. ## Step-by-step Reproduction Instructions 1. Open a web browser of your choice. 2. Now open this URL: https://███/attachments/███████ ## Suggested Mitigation/Remediation Actions Remove document from the internet or put applicable authorization mechanism(s) in order to access sensitive documents. ## Impact Any person can access this document and cause information leakage, target specific person for crime.
Actions
View on HackerOne
Report Stats
  • Report ID: 805027
  • State: Closed
  • Substate: resolved
  • Upvotes: 3
Share this report