Mail.ru: Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly

2014-04-21T19:35:46
ID H1:8803
Type hackerone
Reporter s3curient
Modified 2014-05-30T08:14:01

Description

http://tp-test1.corp.mail.ru/ link has various operations which should not be accessible to an anonymous user.

As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password.

on the other side server information is easily available with version and operating system details.