Improper email address verifiation while saving Account Details
Medium
Vulnerability Details
## Summary:
Attacker could be able change its email to any email address even already created another user's email address.(Even though UI doesnot allow it)
## Steps To Reproduce:
0. Set up proxy.
1. Singup with any email address
2. Go to profile section
3. Click on update button
4. Monitor call in reverse proxy and change email field to any user's email address
5. Done! Attacker is able to change its email address to any email address even registered one's
## Supporting Material/References:
https://hackerone.com/reports/30975
[list any additional material (e.g. screenshots, logs, etc.)]
## Impact
Attacker might be able to impersonate as any other user
Actions
View on HackerOneReport Stats
- Report ID: 825646
- State: Closed
- Substate: resolved
- Upvotes: 32