Lucene search

K
openbugbountyGh05tPTOBB:1040960
HistoryDec 17, 2019 - 12:05 p.m.

storage.gra1.cloud.ovh.net Improper Access Control vulnerability

2019-12-1712:05:00
Gh05tPT
www.openbugbounty.org
14

Open Bug Bounty ID: OBB-1040960

Security Researcher Gh05tPT Helped patch 6878 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affectingstorage.gra1.cloud.ovh.net
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: storage.gra1.cloud.ovh.net
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: IAC (Improper Access Control) / CWE-284
CVSSv3 Score: 6.5 [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **Gh05tPT Helped patch 6878 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations **
Remediation Guide: OWASP Access Control Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAbhUlEQVR4nO2dfUxb1/nHXeIw17FTcIx5DS9W5CDEMkZZRquki1CUAbUYo7RjhNAqyVaEECFRlKWsSmmSkiwFxChDrEqiLEJZNmUIoalDUdRFNMoy2iKPOsQw5gIlDiNAHOpSQwz398f5/Y7u754XXxvMW57PX9zDOc95znOee4/v2/c+IwiCAgAAAAACQNByOwAAAACsWWCNAQAAAAIFrDEAAABAoIA1BgAAAAgUsMYAAAAAgQLWGAAAACBQrNw1JiEh4V//+hdrEwAUC8sKyCgAWAJW6BrzxRdfzM/Pf+9736NuAoBiYVkBGQUAS4OXNWZoaEir1VL/9fjx4zNnzrA2F0h7e3tOTg5r06szq5qZmZmf//znrLBT4UyTrwwNDYWGhi6k+WJ5IoGcYq9ZwYmkpO3Dhw/Xr1//ySefiOuQYxEH5xkaXlvJYYFTIDFFHf7Q0JDE86ysLL6pvr6+rKys5557Ljw8/MCBA48fP0blDx8+3Lt376ZNm6Kjow8fPjwzM8PJAbIy3zgmKyvr97//PXUgKFZeR/T1119HRkb29fXxI8Oqz/KcWhlx+PDhZ599tq6uTuJYQkICp9+1h//nMU6ns7q6mrW5QHxdYxa392VkZmYmMzPT4/EstyMrDnKK+VnBj6Sk7dWrVzUazZUrV+T743a73W63zWYLCQlx/x/ymy87Go3GLaK9vZ1fPzs7OyYmxmazdXd3u93ukpISVF5cXKxSqaxWa2dnZ09Pz9tvv80xwqrMMo7o6+vr7u4uLi5eyIgaGhqKioq2bt3KN8Kqzx8maXxiYqKhoeHOnTs//elPxY6dPn1627ZtMn1YIwhcBgcHNRqNnH9xavqKw+EICQmZnZ2lbvrq5+picHDw9OnTvg5nEYc/ODgYEhKykOYBmgiJZa9ZwYkk2TY9Pb2lpSUiIkJcSLYlg0Mt8dqKzwKngO8Mv5yF2+2ur6+fmppCmz09PTExMYIguFwulUrlcrlQeVdX15YtW1jGqZU5xjGlpaVvv/02a4AoVvwRTU1NJScn4y58rc/ynGVcbH90dDQzMxOXJyUltba2svpdk8g6j/ntb3+bkJCwadOmffv2odPYx48fx8fHu1yuZ5555g9/+IN4s66uTqvVvv/+++Hh4aGhoa+//vq3336L7Hz66ac7d+7UarXR0dGvvPLKvXv3qN21t7fv2bNn/fr15CbVgsSZb7755s033wwLC9u8efO77747Nzen+L9T4zNnzoSFhUVGRl64cAFZe+GFF5599tmwsLBXX331/v37qMcHDx68/PLLWq02ISGhtrYWX7iYmZk5cOCAVquNi4t75513kGUx1IY+dR0XF/frX/+aPx1zc3NvvfVWeHj4hg0bXn311YmJCUkFTgRwHfEFmfv37//4xz/WarVbt25l/Zan2vzZz3723nvv4TovvPDCX/7yFwUtYSQgZ2praxMSEkJDQ/fu3YurUYMsmWKFKCtIH1AFTiQlCfaf//xnZGRk7969qampH330ESvsAYU1BdS5ZiUPq/w3v/kNuTPOz88fOnQoPDw8PDz88OHDOJmp8f/Od75z6NAhlD9PnjxpaWnJyMhQKBQbNmz49ttvN2zYgNrOzs4GBwezOmVVZhlHPH78+OrVq2VlZV5jxRqRQqFobGw8evQoeXGMGhmyPmeYVOMTExM4XTs6Ov72t7/hCRobGzObzYqnCv4SNDg4qFAo3njjDYfDMTAwkJGRUVJSgv5ls9nQOaDH4xFv2u12hUKRn58/PDw8MDCQnJxcVVWFmhgMhvPnz09OTtrt9rq6OrvdTu00Ozu7paWFusmyIHZm//79ZrN5eHjYarWmpqY2NDTggRQXF4+OjnZ0dNhsNkEQmpubL1686HQ6R0dHKyoqcnNzkbW8vLzc3NzR0dGBgYFt27bhH5WVlZUFBQV2u723t3fXrl2NjY0Sz6kNfeoah53zI6u6ujotLa2np2dkZKS8vLyzs1NSnxUByXknHldubq54vqg/oqk2r127lpaWhio4HA6VSvXFF1+wEkYyQBQTh8PR39+/Y8eO0tJSfpAl+YazgvTB6XTyIylJsKqqqmPHjgmCcOXKlddee43TNnDnMawpIOdaYCcPWY7iTO6MqLyysnJsbAyV19TU8OOPaG1tVSqVu3btcrvd5CgyMzPPnj3L6pRa2avxmpqa4uJir7HijMjlcun1eqPRGBUVVVlZifKH4yS1PstzVmVJuiJKS0vLy8vJUKxtZK0x+DTw9u3bRqMR/4t6rQw1GR4eRuWtra3oEDA5OalUKqmpOTw8HB8fj/52uVwajWZycpLc5FjAvXs8Ho1Gg9ee9vb29PR07BU2SzIwMBAREYEsqFQqbKG1tRXv8Hq9Hp8vWyyW7du3iy2wGsrvmhwOFYPB0N3dzarPiQB1jUFui+eLPCCybE5PT2/cuBG1bWpqysnJ4SSMxGFxtVu3buFqrCCL/RdnBekDP5KSBBMEwWQyWa1WZMpgMGCv/F5jFAqFXoROp+OvMZwpIOdaApk84nLWzuh2u+/cuYMrt7W14Tjzk3x6erqzszM5Obm5uVnSY1VV1e7duz0eD6tTamWvxo1Go8Vi8ZqunBHV1NTk5uaOj4+jtUT8o5PqJLU+y3NWZTJ53G53SEgIfzbXJL7djxHvUZw1RqVS4fLe3l6DwYD+LigoSElJOXLkSE1Nzc2bN3Edj8fjcDjQ362trRkZGfhfkk2WBdy7w+EIDg7G5f39/WgPpB61u7u7d+/eHRUVJT4QSCz09vai8snJSfGxQ6fT4XEhWA3ld00Oh8TpdCqVSsnOKa4vMwJ4KtFvf9JtztCwTUEQCgoK0H61e/fulpYWTsJwBoircYIsbkJmhdgHTkdk266urtTUVLxZXFx86dIlVluZa4xarR4RcefOHf4aw5oC6lwL7OQhyzk7oxibzYYm1GuSIz766CNx0ARBaGtrMxqN4+PjAvcIQFbmG8eT5VO6ikckCILJZMJrSXt7O1pLOE5S67M8Z1Umk+fq1avbtm2jDnltowzQJTgqf/zjHz///HOr1epwOI4cOfLiiy9+8MEHCoVi3bp1kZGRqA7/iTKWBf/Izc09ePBgc3OzSqUaGRnJzMzkVHa73UFBQZ999plS+b9BCwry/6k8n7omWbdund9dLy6vvfZaY2NjUVFRV1dXa2srOkj5jcwgS7JC4gO/C0nblpaW3t7esLAw7IDD4Xj99dcVCoVarXa73XNzczjaLpdLrVZ7HUVQUFB0dDTeXOBTguRcs5JnIUk1Pz+vYMf/yZMnFovlBz/4ASo0Go0OhwO3vXv3bklJSUdHx6ZNm7x2RFbmGG9oaDhy5Ij8UZAjevTokd1u37x5Myo0mUxiz0k49UnPfTJ+6dKl/fv3+zeW1Q1/CfLvPEYhOglta2sjz5QFQbBYLJKnRwRB8Hg8er0eX5ORbHIsyLlWJvlZMTY2plQqxdbEJ+ODg4OoXHzhQqPRcE51WQ3ld43xeq3MYrGw6rMiMDU1FRQUJL48Rb340NbWJv9amSAIbrdbp9PV19fn5eWRnvt6HiOwgyyeYklWSHzgdEQmWERERFdXFz7nGB4eDgkJwWfVBoPh1q1buHlTU5P4GSHqAP24H8OZAnKuWclDLWftjDdu3EhJScGVW1tb8ZUlavzdbrdSqcQXGNvb23H9ycnJLVu2XLlyRTxe1hGArMw3rlAodDodOqMKCgrS6/WbNm2ixoo1IrRq4hlva2sTXzwnnWTVZ3lOrSwQaTAyMqJSqcbGxoSnD//XGJfLpVQq+/v7JZv4ZtrIyIjVak1JSUE303p7ezMzMz/++OPx8fHh4eGDBw+azWZsGd1lQVdjcaFkk2NB7MzBgwdzcnL4d7wRBoOhqanJ6XT29/fn5ubioeXn56P7pVarVXzPv6SkJD09HZ1FnTt37uTJk9hzTkOfuqaGXdJLdXX19u3b0X3gsrKyzs7OqakppVJps9nQdRVqBARB2L59+8GDB0dHR9Ftdsk9fzxfuFzcKcumIAiFhYUbN27885//THouObxig5xq1CALoimWZAXpAyeSkrYdHR1JSUmSJvn5+XV1dejvxsZGk8nU2dk5Pj5+7do1nU4nXnLIAZI9UuuQsKaAnGuBnTxkOWtndDqder3+xIkT4+Pj3d3d4hsJrPibzeaCgoKRkRGLxZKUlNTU1CQIgsfj2b17d3l5ufjFFFan1Moc44IgiK83bty4Ef1NjRVnRLm5uZmZmYODgz09PUlJSRcvXhRE9/wlTlLrczynGifT4OzZs5Lnep4e/F9jBEGoqqpSq9X4+jXarK2t1Wg0Z8+eNRgMISEhxcXF09PTgiDMzs5WVVWZTKbg4GCDwVBUVDQ6Oirp5ejRo5WVldi+ZJNjQeyMy+X65S9/qdfrY2Jiqqqq8GMk5IG+s7MzLS1NpVJFREQcOXIED210dNRsNms0mvj4+LNnz4qPuRUVFTExMWq1Ojs72263S8xSG/rUNSvskh/jx44d0+v1KpUK3W8UBOH48eN4LqgREAQBPeil0WiSkpIaGhpwpyMjI3v27NFoNCaTqaamhuo2y6YgCG1tbRqNBs2yzBNfTjUyyJIpzsrKEmcF6QMnkpKMKi4uRk+Uibl48aL4ZkNdXV18fHxwcHBycjL5ZsNirTHUKRAYc81KHrIcOXPu3DnJzigIwmeffbZjxw6NRmM0Gs+dO4c9YcV/bGysoKAgJCQkJibm9OnTeGiS6yKcTqmVOcZZMWTFijWi8fHxwsJCnU4XGxuLnwfjRIasz/GcapxMg8TExLa2Nn4OrFW8rDF+wL/Ow8dkMokfDpFsLgs2m4162zNwDQE+C8mKlZBRAPBUsaT3/L0iEfyRbC4LFovFaDQuZUOAz0KyYiVkFAA8VaxQ3eXlAum9nzp16sKFCw8fPvznP/9ZWVkpUU/i4HdD//wMkHG/kenVSnB+WXwIY/D1118vsSeLy0qYUK+sCifXJCvrPGZ5wXrvU1NTFRUVpaWlsbGx5eXl6ElWOezatcu/hv75GQjjfiPTq5Xg/HL5YLFYqOUBUqpeGlbChHplVTi5VvF+HkPV7mbJaH/55Zfl5eVKpTI8PPwXv/iFWKtKvmQ9X+ibKqOtYKt/s8pJ0JsTQ0ND2dnZn3/++czMzL///e9Dhw7JaYvYuXOnTw39kzqXvOEhDgg5NRIhcVLhnFrfD8c4XnGcl7AonwbwasSrjPci9iUmmoFPBhclRP59C4PaymswJyYm9u3bFxYWFh0d/dZbbz158kShUDx69Gjfvn0owX71q1+hQgUj8TgHHKSfjxTqOCzijCO8BjBwH7lYdXhfY6ii1iwZbbPZnJiYaLPZ7ty5Mz4+Xlpaisp9kqznC31TNbpZ6t8yVcERi56IXvFP6lzipyQgfCFxMnrU+n44xveKVW1ZWAk+sIiLixsfHw90L/59C4Paymswi4uL5+fnLRbLxx9/fPPmzZMnTyoUiv3798/Pz/f09Ny4caOzsxObZSUe9YCD9fOLior4ni/6jHsN4NLM4+qA/0iAT9rd5Ftg4nckZUrW84W+qTLaAlv9m6MKLgHrvS/kuTif8E/qXKJLLwkIX0icjB61vh+O8b1iOU+yKMHnG5HzqYjF6isQLEGI5LfyGkyXyxUUFIRVSm/dumUymdBLl+JC9JYSK/FY3socxeLOuE9dA4Kvzy6jbECKTOXl5QaDwWAwVFRU4LclkpKSkFDr9PR0SUlJQUGBuLlkYtxu9/79+zUaTWxs7IkTJ0hdptnZ2WPHjolVV6urq/HrOBin06nT6cTvynDKPR7P8ePHDQaDWq3Oz8/H0kPNzc1Ic1fmeyEOhyM7Oxu9CiN+SL+rqws9pB8VFZWXl9fb2+stqP8L3tP4EcB+cgKCPdHr9eJdi1OZWl++YzK9ElejTgQKfn19fXx8vE6nKyoqwkciVraQdsQzaLVadTodenWR9IH8vcV6cUdmORX0PodarTYajXV1dT4Z9HV0JGRCOp1OPGQ0TV1dXenp6SqVSq/Xo9cSUS/V1dV6vT4iIuL8+fNkK/kTKhmm0+kMCgoSv6mDJXHF4MSjHnDEZwnIH6+7NqcOuZsjz2tqauLj40NCQgoLC3Eqyg8gNy+eFnxbY8Ta3VQZbbvdvnHjRpVKpVQqExMT8U8ShCTuvqqIs2S0SfVvTjlVLF0Q6b1LnKRq2gts/X+Z3y9gxZYfAeH/69LzRcglQuJeFctZwuNyHJPplbgadSIG2d+SYGUL50sHTqfTZDJ9+OGHYufFPuBrL8eOHUO/hwKxxoi16FnqDyyDvo6OhJqQEuV51kcBJB+kIPXq5UwodZhpaWkVFRWzs7NTU1Nmszk/P5/0HCce64Aj8cfrrs2pQ+7mOALk5ydkBhDWGIQPawwWtebIaJeXl6empnZ1dV2/fj0mJub8+fNiC5K4+6oizpLRlqh/Y6jlVLF0sd67HO0vlow/5+sDfGRKnUt06Tki5KSQOF+xnCU8LscxmV5JqlEnYpD9aQBWtnC+dJCdnS0+LpA+IKxWa2xsLOd3t/xyEpYWvUyDPo2OhJWQHLfFHwWQBIo8xZczodRh9vb2pqSkBAcHI43R69evSxqKE491wPEaK5lOUnfzQfbnJ8iuxeAAwhqDkLvGcOS4sYz27OysWq3u6elB5VeuXJGoYYrj7oeKOFVGm1T/RlDLWWLpYr13sZMsTXuWjL/A/voABz+kzjkBQZBC4pzK1PryHZPplbgaayJYhyRWtnC+dFBZWRkUFIT1o0gfMC+++CLW+Vj4GiP+cozA1qKXY9DX0Um6RlATUtI79aMA5CFSUriQCcWt6urqSM1cfuLhA47XWMl0krqb8z33L4BPJ7Lej/Gq3Y1ktCcnJ2dnZ7/73e+iwpSUlJGREZZNX1XEWTLaLPVvjio4KZa+iI+d+Pr1AZ+kzsV+8nXFJULiXkXISeFx+Y7J9IoMsvwvFPA1/0k709PTra2t6Bu9eXl5zz33HMuH3/3ud0aj8Sc/+YlMT7zCegnGb+SPjtq1nIT076MAC5lQhFqtrq+vb2xsFBfK+VIAOuCQyNm1A/FdjAV+qmON43UVIkWtOcLgKpVqYGAAl2Ola4Rkbdf4oiLOktFWEOrf6Eccq5wUS5fovcu/VjZI0/8XQ/1+gRifpM4lfnJ0xUkhcU5lan35jsn0ihTkJydC4P7spWYL1c7g4KBSqURPW5jN5rKyMlRO+jAyMpKYmCi+IsT6AgKr3NdrZViLXqZB+aOTA05IcS+sjwLwz2NkTij1uTL83w8//FDyrTNq4rEOOF5jJdNJ1rUymecx8gP4dOJljaGKWnNktMvKyjIyMux2e3d3t8lkkjxcJIm7TyriAkNGm6r+zSknxdIleu8ydfKpMv787xfIiS0nAqSmPUtXnCokzqpM1vfJMZlekdWoqvWcHZuVLaQdsRGbzaZSqdD1W9KHvLy8a9euScbI+gICtVySLVRYuv1Ug+Q9f5mjo8JKSMmHOagfBSAPkeJWMidUEITMzMyioiJ85xy/S+DxeIxGY3t7O7bASjzWAcdrrOQ7Se7m/DXGvwA+nXjX9pec96BAc4TBy8rKDAZDbGwsfthMbE3y7LJ8FXGBLaONjVNPJiTlpFi6RO9dkKeTT5Xx5399QGZsWREg/WQFhCokzomepL5Pjsn0iqxGVa3n7NisbCHtSIyUl5e/9NJLVB+o5/SsLyCwysXZQkX87LL4MXeqQfLZZZmjo8JJSPGHOVgfBSAN4lYyJ1QQhLGxMZQPUVFRx48fxw/HX758WXISw0k86gHHa6zkO8l6dlnsm+Tw4l8An0IWX9t/1bFwvfelkfFfmbr0Mr1aCc6vBB9Yv4RWHSshmF5ZFU6ueZ4RiF9zgK/86U9/qq+v/8c//rHcjgArnaGhoZSUlEePHi23IwCwRKxN3eWEhIS2traAyqyeOnUqKioqJyfHbrdXVlaeOHGCVTMsLIxabrfbQTUPAIC1zRpcY5ZGx1u+jP+aVHQHAACQw7JdKxsaGkpOTg7E15nee++90dFR/lspAAAAwBKwBr+DuZKV2wEAAJ4q1toa8+DBg/7+/l27di23IwAAAIC3NQZ9za22tjYhISE0NHTv3r3404czMzMHDhzQarVxcXHvvPPO3Nwcrn/mzJmwsLDIyMgLFy7I9OObb7558803w8LCNm/e/O677yJrDx48ePnll7VabUJCQm1tbWhoKKr86aef7ty5U6vVRkdHv/LKK/fu3cN22tvb9+zZs379el8DAQAAACw63s9jXC5XT0/P7du3u7q6hoeHKysrUfnJkyenp6d7eno6Ojo6Ozubm5txfZvNZrVaL126tGPHDpl+lJeXOxyO7u7ujo6O9vb2pqYmhUJRVlYWHBw8MDBw48aNy5cv48pms/mNN94YHh6+devWjh07VCoV/hdcKAMAAFhB8F+f4QhcU7XWqZLgLMt8WTA/9POpyu0AAADAcuH92WWNRoOfso2JiUEq648ePRofH4+Pj0fl8/PzWBBXo9Hgi1oyGRsbm52dTUhIQJuJiYmDg4NjY2Pz8/PiQvRHaGhofn5+enp6RkZGVFRUWlraj370I/Sv69evb9++3dfeAQAAgADh5/sxfK31QMOSK4cLZQAAACsKP9eYyMhItVo9OTn5/e9/f+FOGAyG4ODgL7/8Ep212Gy2+Ph4g8EQFBQ0NDQUFxeHCsVNnn/++eeff16hUGRnZ5vN5g8++GBubu6vf/0r5317AAAAYInx/+SjqKiotLT07t27Dx48eP/990+dOuVTc51O53a7+/r65ubm1q1bV1BQUFFR8dVXX929e7eqqqqwsHDdunVms7miomJoaAgVoob37t3Lysr6+9//PjEx8dVXXzU2NqakpCgUitu3b0dEROBrawAAAMCy4/8aU19fn56enpmZuWXLlps3bxYVFfnUXKvVHj16NDU1taWlBVmLiIhITU3NzMzMyckpLS1VKBSNjY0ejyc5OdlsNhcWFqKGW7ZsSU9PLykpQTdj3G73+fPnFXChDAAAYOWxanSX+/r6Xnrppf/+97+sClu3br18+fIPf/jDpfQKAAAA4LBqNDEtFovRaORU6OvrWzJnAAAAADkEfI1ZiLK9fP18AAAAYAUS8Gtl9+/fp5ZHR0d7bfvJJ59UVFRYrdbY2NiysrJDhw4ttncAAABAAFk192MAAACAVcda010GAAAAVg6wxgAAAACBAtYYAAAAIFDAGgMAAAAEClhjAAAAgEABawwAAAAQKGCNAQAAAAIFrDEAAABAoIA1BgAAAAgUsMYAAAAAgQLWGAAAACBQwBoDAAAABApYYwAAAIBAAWsMAAAAEChgjQEAAAACBawxAAAAQKCANQYAAAAIFLDGAAAAAIEC1hgAAAAgUMAaAwAAAASK/wFjWuSTXNNnogAAAABJRU5ErkJggg==)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAWtElEQVR4nO2db0xTVxvAa62k1opQSkGovNCZyohzxDDGFnXGuA0ZQcbQMEVm1DlCCP6JYcqMY84oMegIc4QZZ5wxzC2GMD4sxJBlYcSZqtix2hVGWCW1Y1gRtGOXWrnvh/Pu5O6eP/depFp8z+9Te/qc5zznOeeep/fc06czeJ5XMRgMBoMRAtRP2gAGg8FgPLWwGMNgMBiMUMFiDIPBYDBCBYsxDAaDwQgVLMYwGAwGI1SwGMNgMBiMUKEgxqSkpPz888+TaGPSFRkMhlKmy+UWnnbKtCocjA8HG+QgN8b88ssvExMTzz//vNIGJl2RwWAoZbpcbuFpp0yrwsH4cLBBJnJjTGtra15eHunT8fHxt99+e+7cuZIVb9++PWvWrB9//FEoc/PmTVHdmzdvRkdHg9czcEjWkoNSeUltWA/cvHlTZPyaNWsoenp6etasWTNv3ry4uLitW7eOjo6C8tu3b2/cuDEmJiYxMXHXrl3j4+OkFrHCdOWQNWvWfP7559heAF9Jduf+/fvz58/v6emhu4UkT7IcKwzYtWvX7Nmzjx8/LjIsJSWF4jpSL37//fe1a9dGR0fHxcW9++67QhdR5rkIup+xvVCRnU8qRwGXm6TPp5DJzTTRsoDOGdJQyheehGHoKocdKfpiOCXOl1RCtyGsmIIYMz4+np2dHQwG5VQ8f/68Xq9vamqSbyLHcRzHuVyuqKgo7h/kVw8H9Ho9J6C1tZUinJOTYzabXS5XV1cXx3GlpaWgvKSkRKvVOhyOjo6O7u7u/fv3U5SQhEnKAT09PV1dXSUlJY/Snfr6+uLi4kWLFtGVkOTp3USV37lzp76+/vLly2+++abQsEOHDi1ZsoSik9SL3Nzc1NRUl8t1+fJln89XVlYGyunzXATdz1gXkZwvc1AAj3/pmdxME9mJOoQ0lPKFJ2EY6j3sSIXD+h4ONsiFl4HX642KigoEAthP3W73oUOH3G63Xq+XrJiVlXXu3Ln4+HhhIVrX7XZHRUVJlkjWoqNUXlIb6gFKORaO4+rq6u7duwfednd3m81mnuf9fr9Wq/X7/aDcZrMtXLiQpBkrTFEOKSsr279/P6l3wFf07ty7d2/x4sWwCaXyJMtJyoX6BwcHs7OzYXlaWlpzczNJJ8mqoaEhjUYD39rtdugiyjwXQfczthc82fmUQREBLzdFU+5RmNxMEy0LqENIQylfeBKGoYsVdqToiyGv8HqfnBJJG8IKWTGmsbFx/fr1PM+vX7/+0KFDsDwrK+vMmTPgNdYpsCKgr68PjGhOTk5LSwssf5wxxuPxvPbaa3q93mq1Hj58GMoHg8G9e/eaTCadTldYWOjz+Xiet9lsWVlZWq3WaDQWFhZ6PB4gjC0H9tTU1JhMpqioqJKSkrGxMVCu0+kqKipMJpPJZNq5c2cwGOR5nuO4LVu26PX6pKSkAwcOgEIhgUCgsrKypKQE7UVnZ2daWhqpRaywpPKRkRGDwTA4OEj3Fak7gMOHD8MpAaAbicpTLEeFfT4f/LYk/MhmsxmNRuxFCF1H6kVaWtqJEyd4nh8bGystLS0qKkK7A99OYhCxXUadTynHzlVecLmJjPT7/du3bzcajWazubq6Ghrp9XpzcnL0en1ycnJtbS28Fmw227Jly/R6fUJCQkFBgdPpRN2IReZMEy0L9DkgGkpFwooME1lFaksohh0I4Py6urrk5GSDwVBcXDwyMgLkSbMF1SMcQYfDYTAYOjo6sDaEP7JiTE5Ozrlz53iev3DhQkZGBij0er1arRa6DxtjYEVAdXV1ZWUlz/NNTU1CHz3OGJOfn19YWDgwMNDX17d48WIof/jw4YyMjO7ubo/HU1FRAUa0sbHx9OnTIyMjg4ODO3fuzM/PB8LYcrfbrVKphMqrq6theVVV1dDQECivra3leb6qqqqoqKi/v9/pdK5cuRKsa5Dm5maNRrNy5UqO49BeZGdn19TUkFrECksqr62tFcUzrK9I3eF53u/3G41Gi8WSkJBQVVUFLiGKkVh5kuUkYZfLBbZKhNXLysoqKipQV4hch+1Ff39/ZGSkVqvVaDSpqanwuzBANOuUDiKpF6jzKeXYucoLLjeRkVu2bMnNzR0YGHA4HEuXLq2vrwflBQUF+fn5g4ODfX19S5YsgdeCyWQ6derU8PBwf3//8ePH+/v7sZ4k+ZbuAf7fy4LkHBAOpSJhpYaJFitSW0Ix7ECAqbV582av19vX17dq1arS0lIgT5otqB44giMjI1ar9eTJk0LjRaaGOdIxxu/36/X64eFhnufHxsYiIyMHBgZ4nm9oaMjLy4Ni6IovrAiwWq0OhwPoMZlM8CZ00jFGpVIZBRgMBnqMCQaDWq0W2M/zfHNzs/C66urqotTt6+uLj4+nlAN7hMpBPOY47vLly1C+paUlMzOT53mj0QjXL7vdDgohY2NjHR0dixcvbmxsFLVYXV29evXqYDBIahErLKncYrHY7XboZ5KvSN3heb62tjY/P9/n84FVG6xlFCOx8iTLScLo5OE4LioqCjuaUCelFxUVFUuXLrXZbBcvXjSbzadOnRJqEDWndBBJvRA5H4Itx85V4eUmNDIYDOr1ehgnWltbs7Ky+H/GF5bD8R0eHtZoNNhvNnRkzjTRskCfA6KhVCSsyDB0scK2JRLDDgSY8HBxu3TpksViAa9JswXVA0cwJyenrKxM+BFqapgjHWOam5tXrVoF3xYVFQF3r169WhhL0UtdVNFmsy1duhS+LSkpoeyzyYwxOp3OI+Dy5cv0GAPuveBbp9MJ5EdGRjQaDfq1qKura/Xq1QkJCaIAhi13u90i5SaTCbXB5XLFx8cPDw8LA6TBYMAKf/fdd0Kn8Tzf0tJisVjgXTm9RaEwXTkcLOhnkq+w3QGvrVYrjCWtra0gllCMxMqTLCcJo5Pn/PnzS5YsQU2leAP2IhAI6HS67u5uUN7U1CQK28LmJjGI2F6gzgdgy0lzVXi5CY30er0RERFQrLe3F/RUVC4c36KiovT09N27d9fW1v7www9oj1AmMdMoDoGIhlKRsCLDRFaR2hKKkQZCNCHh2JFmC1YPUFJVVaVWq0+fPi38CDU1zNFIHgoQHWBYv379iRMniouLbTZbc3Oz/Irnzp1zOp2xsbHgLcdxXq/3nXfeUalUOp2O47iHDx/OnDkTfOr3+3U6naRtarU6MTERvpV55ocEbB2Sn5+/bdu2xsZGrVbr8Xiys7Pp5TKZmJjgOE6tVl+9elWj+d8QqNVqlUr14MEDu93+wgsvgEKLxeL1emHFGzdulJaWtrW1xcTESLaCClOU19fX7969W1EvhN1RqVR3797t7+9fsGABKLRarULLUSjyqOWKlJ85c2bLli2iQknXgV4MDw8HAoHnnnsOFKanp3s8HlJDSgeR1AuS8ymDgs7VKTxo9NVXX127ds3hcHi93t27d7/88suffvopRV7RTBPaKTmswqFUJKzUMJH3SG2hTkYHggRptpD0jI2NNTc3nz9/vry8vKCgYN68eaB8Op0oA9BDUDAYNBqNwg1ZjuMMBkNdXV1BQYFQUhS9RRWDwWB8fLzNZoP3HAMDA1FRUV6vFwiYTKbOzk5YvaGhQXhWhJ+i5zGi/Z+WlhbhXpndbhcKo0eMgDCpXLQp1NLSAr77tLe3p6enQ/nm5mZwj6zX69EbbY7jNBoNvBFubW2FN9TDw8MLFy5samoS9hfbIlaYrlylUhkMBvD1Sq1WG43GmJgYrK9I3QGXEBzxlpYWsCdDMpIkT7IcK8wj08Dj8Wi12qGhIWF1VCepFzzPa7Xavr4+WA4bwjanaBBJvUCdbzQaKeXoXBVdbvL3ytxuN+wp9toRnqzDomimieykDCuPDKUiYUWGYVc5tC1UDB0InnwfwxNmC1aP2+3WaDTgtEVubm55eTkoR20IfyRiDNiyFBVu2LAhMjLym2++ERaKPCuq2NbWhp7rKCwsPH78OHh94sQJq9Xa0dHh8/kuXLhgMBiEIYef6mf+Ho/H4XCkp6cLn/lnZmaCx27l5eXg8Z3JZGpoaBgZGent7c3PzxcGJLQcPtyGysHD7ZGREaPReODAAZ/P19XVBfd2S0tLs7KywLfFo0ePHjx4ECjPzc0tKiryeDx2uz0tLa2hoYHn+WAwuHr16oqKCuFPOkgtYoUpynmeF+43RkZGgtdYX5G6A3ybnZ3tdru7u7vT0tLAPT7JSKw8xXKscnQa1NTUwKMZAKxOSi/Ky8tXrVrV39/f1dVltVqxx+TgW0WDSOoF1vmUcnSuii63e/fuaTQal8sFdmC2bduWl5eHPvMvLCzMz893u90OhwM+83c6ndnZ2d9//73P5xsYGNi2bVtubi7palI609D1hDSs2KGUL6zIMOwqh7aFimEXDUqMIc0WVI9Qicvl0mq1YP8Wa2qYIxFj9uzZU1VVJSpsaWnR6/WiY7Iiz4oqlpSUgBNlQk6fPi182HD8+PHk5OSIiIjFixfD4/BC/VN+dll4XjMYDFZWVhqNRq1WC5718Tzf0dGRkZGh1Wrj4+N3794NhbHlwJ6jR4+ih3SvXr0KDoNaLJajR4+CQo7jdu7caTabdTpdTk4O/G4yNDRUVFQUFRVlNpvhSXGwUguJiooitYgVpign+ZDkK2x3eJ73+XwbNmwwGAxJSUnwGA/FLag8xXKscnQapKamCo/FU3SSesFxXHl5uclkSkpKgofNSM0pGkRKL1DnU8rRuYpep3v37tXpdCBAks4uDw4O5ubmgrPLNTU1oIlAIFBdXW21WiMiIkwmU3FxMXqiWtK3JA+gdlIcgg6lfGFFhmFXObQtVAy7aFBiDGm2oHpESioqKlasWEEyNcyRiDFWq1V4/EY+k67IYDCU8uiXm8vlwh5YmFrCc1mQaVU4GB8ONihlBs/zEk9sGAzG087XX39dV1f3008/PWlDGE8b0ufKpiPw9JqI/v7+x5YrUERKSkpLS0uY50mdFkaGFdPaYx9//HFCQkJeXl5/f39VVdWBAwdIkmF4QTGmC09njLHb7djyJ3U9TItE3NPCyLBiunts5cqVO3fuLCsrS0pKqqioAD8kwBJuFxRjGvE4/gdzyjONSyoMBoOpqamJCPKbGB0dPXLkyCRsw1akH2m/c+fOpk2bYmNjExMT9+3b9+DBA1B+9+7dTZs2geTk77//PixXlKle9U/q+y+//JJu+dSeu5fjwMeQgj6kTUy/Xyr8m+XLl1+7dm18fPy3337bsWMHRRK9lJReUIz/Xx7DM59QZIGl57p49BYnrQFbMTMz8+LFi6QqOTk5GzZs8Hg8LpcrKysLJtnNz88H5U6nMysrCx75zc7O3rJlC8yGtGfPHtCo8JgmTAvo8/nUarXdbkd/kKzISKXIdOAkcpaEwozJMbUeYzCeSqZrjAl1i1MYY+iJuP1+v1qthqlFOzs7rVYr/8+PxYTl4AdGijLVy+/IlGcLf/yD/pjNmF751RmMJ4X0XploE0a0+SD8K0nKR3Ru3br1+uuvz5kz55lnnvnkk0/g/y3Kaejhw4f79u2Li4ubM2fOunXr7ty5I1J+48aNmJgY0T9vCrly5cry5cvnzp2bmJj41ltv/frrr6Ojo8nJyX6/f8aMGWCL6cqVKy+99NLs2bNjY2PXrVt369YtaMaRI0diY2Pnz5//xRdfoBVVKlVra+trr702a9YsrLU+n0+n08FEEWazeWhoSKVScRw3MTEREREByrVa7djYmEqlmjNnzt9//z1nzhxQHggEgMzExMSOHTvi4uLi4uJ27dr18OFDlUp1584doT0UX9GNVKlUf/3113vvvRcbG7tgwYKPPvoI6AceOHbsWEpKSnR09MaNG8G/CipyIEUPYHx8fOvWrXPnzv3Pf/7z4YcfPnz4EPW8jFn2P7Ad+eOPP9544425c+empKQcO3YMzjR0bmA9xmAwSEjHGLj9UllZWVRUFAojysvLIyMjXS7XxYsXz5w5o6ju0aNH29vb29vbe3t7ExISnE6n8NPR0dGCgoKamprly5eTNOTm5m7evHlgYKCzs3PZsmVarXbevHkwY3xxcbFKperq6tq+ffvg4KDD4TCbzeXl5aCu3+93uVwOh+PMmTPLli1DK6r+vWtPt1bIvHnzli5dWlVV9eDBg/v371dXV2dkZKBihw4dAv+QODY2ptfrHQ7HpUuX2tvb6+rqVCpVTEyM0B5K65JGVlRUeL3erq6utra21tbWhoYG6IHu7u5Lly7ZbLaBgYGqqipgvEwHQrB6AAcPHhwbG+vu7m5ra+vo6GhsbEQ9T3IjCrYj5eXlERERfX197e3tZ8+ehcLo3MB6jMFgEJF5v+NwOJKSktAfoAp/xUr6iL5fQcohL7MhUnptUmZsEaRM5hSbRcn8RUm2RRUlk4FTuul0OtPT0yMiIkB6UHTrX06meklfyTGSlPNKlMa8s7MTpjGX6UAgQ9HD4zKiYz2PBU2jh3ZkElnup11+dQbjSSH37PL27dvr6+tjYmL8fv8jRjXhWfvbt2+DrSGY4jQ1NVW+qtHR0eHhYeF/fQv54IMP2traTp06RWk9Ojq6sLAwKytr1apVCQkJGRkZr7zyCqrq+vXrlZWVTqczEAhMTEyAHL0qlUqv19P3Ay9evJiZmQlk6NaiPPvss9evXx8dHT19+nRTU9Orr74q/PTbb789e/aszWabOXPmzJkzX3zxRfhRamrqwMCASBuldUkjh4aGAoFASkoK1A9zdej1erhvaTabQQJzFJIDISQ9d+/e9fl8ycnJ4O3ExARIWyvpeSzYjgwNDU1MTAgLwQvK3BB6jMFgUJAVYz777DOLxbJ27dopaZJ01n7SYNNrkzJjo63LyWQ+6WT+j5IMHKDT6erq6k6cOCEslJmpHgXb+qMbKcmkHYjNiB4IBKbWPBKkucE2yhgMuUje6Xg8ntTUVLgtcO/ePbVaLdzWgHs7pI8U7ZXBHPKUhkT7P9j02tjM2JLATObCJijJ/NF+idKqSyYDJ50rg5w8eVL0N2WKMtVL+kqOkZS9Mjn7mZIOpOjhcRnR5Z8Wk79XJj/L/XTMr85gPCmkY0xBQcGFCxeE+bEzMzO3bds2ODjY29u7bNky4QWJ/UiUaRyFlG+f1JBw4ZBMry3MjI1CymTu9/s1Gk1vby8QIyXzR1c6YUWZycCzs7OLi4u9Xi/oJvx9DM/zwWDQYrG0trYKSxRlqpf0lUwjsfnhKbFBkQPpMQbNiC4/xqBzD9sRRVnup2N+dQbjSSEdY9D7HvDTP71en5aWVl9fL1wOSB8JM42jgBzyOp3OYrEIc8iTtInuFSTTa8PM2CiUTObV1dXQZkoyf1QnrCgzGfjQ0BDIIp6QkLB3717hTy7Onj0ruolRmqle0lcyjcTmh6fHBvkOpOtBM6Ir+tWLaO5hO6Ioy/10zK/OYDwpwi7v8s2bN9PT0+/evfukDZkCFi1adPbsWeHT+DBkWhj5OOnp6VmxYsWff/5JEmAeYzDk83TmxAwTenp6nrQJ0kwLIx8ndrvdYrFQBJjHGAz5sBjDeBp4xOTz8rPcMxgMRbAYw3gaeMTk8/Kz3DMYDEWE3fMYBoPBYDw1PI7/j2EwGAzG/ycsxjAYDAYjVLAYw2AwGIxQwWIMg8FgMEIFizEMBoPBCBUsxjAYDAYjVLAYw2AwGIxQwWIMg8FgMEIFizEMBoPBCBUsxjAYDAYjVLAYw2AwGIxQwWIMg8FgMEIFizEMBoPBCBUsxjAYDAYjVLAYw2AwGIxQ8V/PPuJdN+Xl0QAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAGZ0lEQVR4nO3bX0iTaxwH8GdTtrm22ua2zGZqQUWEFI5QsALposYQoTSJVUKxIrRkFxFBtYps6VUl1oUX1U13Y0iIVxUjhFbMF/EfTmp/clu5tpZrvS7dey6ec4ZH6+zoOa95Tt/P1eu75/09v8ebr8/7OAHHcQQAAIAHwp/dAAAA/G8hYwAAgC/IGAAA4AsyBgAA+IKMAQAAviBjAACAL8gYAADgCzIGAAD4spSM8fl8crn8X29lrsnJybq6OqVSKRAIBALBunXrzp07Nz09vdg6/7DVeDx+8+bNJT8OAPCLW6H7GLPZnEqlGIZhWZZl2efPnw8ODtpstmVu49OnT62trcs8KQDA/8ZKzJhv3749efKkq6uruLhYLBaLxeItW7a0trba7faf3RoAACxC9ox59epVZWVlXl6eRqOpq6ubmJig92/durV27VqlUnn8+PGvX7+SBS+mfD6fUqmcW2f37t1yuXz9+vUHDx4cGRkhhExPT584cUIulxcXF1+5cmV2dpYQEg6HRSKRRqMhhLx8+XLTpk1KpbKnp+fdu3e01JcvX06dOqXRaIqKiq5evUqfOnz48I0bNzLTVVZWPnz4kF7fvn27tLQ0Pz//6NGj8Xh83gJp2+3t7fOWE4/HS0pKEomEQCDIlAIAgL8ve8a43W6z2RwOhwcHB3U6XVNTEyEkkUi8/oPb7W5ra8tax2g0NjY2+v3+Fy9eVFVVSSQSQsi1a9eSyeTAwEBvb6/T6bx//z4hJJ1OC4W/N9bU1FRfXz82NuZ2u9PpNL159uzZYDDodrt7e3u7u7s7OzsJIfX19Q6Hgw4IhUIMw9TW1tJWGYbp6+tzuVzBYPDChQsLe0skEi6Xa95y1qxZMzo6KpPJWJY1mUzZf5cAADAPtxjj4+MFBQVer5cQ4vf76U273a7X6zmO83q9MpksM9jr9SoUCnodjUZzc3NZlp1XUK1WJxIJes0wzK5du+bWSSaTQqEwEolwHPf06VNabWZmRiaTvXnzhj7V3d1dUVFBB69evZp21dnZWVNTQ0sRQj5//kwH9/X1bdy4cV4PP1rOwhUBAMCi5GYNof7+/vPnzw8PD6dSqXQ6TTcTEomkqKiIDti6davf7//rIkql8tChQxUVFdXV1YWFhXq9fu/evbFYLBKJlJSU0DHpdDo390/9RKNRkUiUn59PCNHpdPTmhw8fUqlUaWlpZnYaEnl5eQaDweFwNDc32+32xsZGOkAmk2Xe4BUWFkaj0YXtLXY5AADwd2R/V1ZbW7tnzx6n08kwTE9Pz5Jnevz4cVdXV1lZWSqVslgszc3NLMsKhcLXr18zDMMwzMDAAMMwcx+Z+9Is86LsL9DXZbFYzOVy1dTULLlVAAD4V2TZx0xOTgaDwUuXLtEfI5EIvWBZNhAI0L/9x8bGNmzYQAhRqVTJZHJqaoruGzJH9Bnl5eXl5eWEEIPBYDQa7969K5VKo9Hozp075w4TCoU0UVQqFcuysVhMqVRm9hZarVYkEr19+5ZuZUZHRzM7IYPBcPLkyUePHu3bt29RX4v57nIAAOAfyrKP0Wg0KpXq3r178Xjc4/FYrdbMRxaLZWJiYmhoyGq1Go1GQohcLtfr9RaL5f379x6PZ+7p+sjIyIEDB549e/bx48dAINDR0bFjxw5CiMlkOnPmzNDQUCgUam9vv379OiFErVanUqn+/v5Vq1ZVVVXZbLZQKNTR0UFL5eTkNDQ0tLS0BAIBOvuRI0foR2KxeP/+/ZcvX25oaMi68nnf6Fy4HNoJy7IejydrNQAA+I6sJzZOp1Ov10skkoKCAovFolAo6El4W1ubVqtVKBTHjh1LJpN08Pj4eHV1tUwm27Zt2507dzJn/qlUymq1bt68WSQSabVak8kUDoc5jmNZtqWlRafTSaVSg8GQOcm3WCynT5/mOG54eLisrEyhUFy8eDFTLZFImM1mtVqt0+msVuvMzEymW4fDIZPJMv386N8Q5t6n1zabbeFyOI6zWq1SqfTBgwdLOOwCAPjFCTiO+9kx932zs7M5OTnLMJHP59u+ffvU1NQyzAUA8EtZid/zp5YnYAAAgD8rN2MAAOC/DhkDAAB8WbnnMQAA8F+HfQwAAPAFGQMAAHxBxgAAAF+QMQAAwBdkDAAA8AUZAwAAfEHGAAAAX5AxAADAF2QMAADwBRkDAAB8+Q31NSJWXaF6UAAAAABJRU5ErkJggg==)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 17 December, 2019 12:05 GMT
Vulnerability Verified: 17 December, 2019 12:15 GMT
Website Operator Notified: 17 December, 2019 12:15 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 17 December, 2019 12:15 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 16 March, 2020 12:05 GMT