Lucene search

K
openbugbountyBroly157OBB:1119176
HistoryMar 16, 2020 - 5:27 a.m.

widex.fi Cross Site Scripting vulnerability

2020-03-1605:27:00
Broly157
www.openbugbounty.org
9

Open Bug Bounty ID: OBB-1119176

Security Researcher Broly157 Helped patch 1571 vulnerabilities
Received 7 Coordinated Disclosure badges
Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affectingwidex.fi
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: widex.fi
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **Broly157 Helped patch 1571 vulnerabilities
Received 7 Coordinated Disclosure badges
Received 15 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAVbElEQVR4nO2df0xTVxvH72qFWsoPoVTA6krn0BDmiFGCDB0xxHWMEOZ0Y/hbiTJjKhLc0JCNOaJMZa9jhhCDRheixmyGEWfMwtxCCNvUudp1DBmpFWvtELA6xAqV8/5x3p3c9/443LYUQZ/PX73nnvuc53zPuX3uPffcc59DCDEAAAAAEABkT9oBAAAA4KkFYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKMZvjImPj7969arY5rNMIKQAeQEACATjNMb8/vvvw8PDL7/8suDms0wgpAB5AQAIECPEmBs3boSGhgruunfv3t69e8U2/aSxsTEnJ0ds84lDkeXGjRtTp0710/727dunTJly/PhxfkFsKSjZxGx+9tln/JxjLy/F4bt3765fvz46Onr69OkffPDB0NCQD/arqqqioqJmzJjx7bff4pRvvvlmwYIF7Dx37txZuXJlVFTU9OnTt2/f/ujRI3q6FJvXrl17/fXXw8PDp02btnHjxnv37vnvp3SbUrqBdPzRsLe3d/Xq1bgRd+7c6Vsj+uAPI02uEU/S8Vb3iQ2iYrPZVCqVlF2UnD6QkpLy3XffiW2OB9xut2C6zWaLiIjwx3JPT49MJjOZTB6Ph18QkYKejWKTn3Ps5aX0lpycnPz8fLvd3t7enp6eXlpa6q1xl8slk8laW1uPHj2q1+tx4pIlS06fPs3OZjAYNmzY4HA4Ojs7lyxZUlJSQkmXaFOv1xcUFDgcDrvdnp+fn5eX57+fXtmkdwPp+KlhVlYWacTU1NSysrKx8QdJk4t+ko63uk90xmOMcTgcERERg4ODgpvjHP9jDEVJthReCS7R5pgh5s/AwIBWq+3v78ebFy9enDVrls/GSVtYLBaOnf7+foVCwS9ILF2KTbfbffDgwfv37+NNs9ms1Wr99NNbm6OFnxrKZDKXy4XTW1paEhISxsAfJFku+kk63uo+0ZH0PObzzz+Pj4+PiopavXo1vve8d++eTqfr7+9/7rnnjh8/zt7EozH79++fNm3a1KlT165d+/DhQ2zn0qVLixYtCg0NnT59+ltvvfXnn38KFtfY2Lh06dLJkydzNt988839+/fjxKtXrwYHB5Mb4c2bN+/YsYOe4cUXX6QfzvaBbmrz5s3sQYlbt2699tproaGhs2fPPnHiBEl/9OjRxo0bQ0NDn3/++Y8++ujx48fXr18PCQn57bffGIbp7e2dOnXqDz/8wC63t7eXLSxn9INIQc/GgZ2ZP1bGVluwgfi1wAdeunRp4cKFU6ZMiY6OXrFixa1bt5h/h2v27t0bHR0dGxt75MgRhmEeP368c+fOadOmhYSErFixore3F1vg96spU6bcvHkzJCQEZ+js7IyLi2OLHBIS8sILL/znP/+hjHWoVKqBgYHr16+3tbWpVCqGYaqrq0tKSth5QkJCHj58SAoaHBwMCgqipEuxGRwcvG3bNizv0NBQfX39kiVL8C5BDf20yVeV3Q3w76qqqvj4+JCQkHfeeae3t3fHjh3R0dFRUVHr169/8OABznn79u033ngjNDQ0Pj6+qqoKC+uPhj09PUqlMjw8HKdrtdru7m7SZzgdTGKHkeIPXS7Bk1TwfAxE3R88eLB58+bo6OgZM2Z8/PHHuAOw22jq1KkrV64kfzKCHUZQqwkAPQTZbDaGYdatW0duCQsLC/Gu9vZ2lUrldrvxWA3ZtFqtDMMsX768q6urs7MzKSmpvLwcH6LRaOrq6vr6+qxW62effWa1WgULzcrKqq+v52/W1dUtXboUJ1ZUVMjl8lOnTuFNvV5/4cIFeoaSkhL64Wwf6KZOnjzJvgzPzc1l15dcIu3atSsvL89qtba1tWVkZBw6dAhbW7x4MUJoy5Yt+fn5/OqzheVc77OVoWSj2LRarZycbJuCDSRYC4RQbW3t0aNHXS6X0+ksKirKzc1F/3aYNWvWOJ3O8+fPt7e3I4T27Nkzf/58s9lst9uNRmNzczOlX7F9jouLu3jxIl/kuXPnEpHVPBBCRqNRLpcrFIra2tq+vj6dTkcfRDIYDJWVlfR06TbPnDkjl8szMjJIBjEN/bEpqCppXKzwqlWr7HZ7R0dHenq6Wq3Ggnd0dGRkZBiNRpxz2bJlubm5TqeTI6zPGvJHOIhNfgeT2GG89Ycvl9hJKng+jnrdN2zYkJ2d3dXVZbFY5s2bV11djVgnC26U9PT0LVu24AMFO4ygVuMfSTGG3Hu2traSAUqxsTJ8SFdXF04/c+bM/PnzEUJ9fX1yuVywqbq6unQ6Hf7d39+vUqn6+vr4mw6HQ6lUYgspKSnFxcW4T9hstrCwsMHBQXqGrq4u+uFsl+imOjs7Sd09Ho9CoWDXl/33R+6mTSZTSkoKQmhwcHDOnDnl5eVqtdrpdApqzv6nIL85yohlE4TdOuycbJtiDSRYCw6dnZ0xMTHo39YnTmI0Gs2VK1c4/oj1K4zdbtfr9SSuU0S28yBVw3XZt29fRUXFxYsXDQZDWlpaXl4eyYMpLy/PzMzEl0r0dIk2BwYGmpubk5KSamtrR9TQZ5uCqnJiDHvQRiaTDQwMEMHx2A4WllztsYX1WUOx/1nBDiaxw3jrD0cuSv8ROx9Hse4ej0elUhGRGxsbU1NTEe8saGlpIWeBYIcR1Gr8493zGPYlCSXGKBQKkt7W1qbRaPDvvLy85OTk4uLiAwcO/PjjjySPx+NxOBz495kzZ5YsWUJ2cTaTk5MvXLjgdDq1Wq3L5dJoNB6Pp66ubtmyZVIyjHg4G0pmdt0dDgenvuSMYhiGXFxHRkYSHZqamhiGwdcydM3ZvzlSiGXjXNHzW4fdahyb/Aai1OLKlSuZmZlxcXE4HdeaH+1cLpdcLuf8g1P6FSY1NZWtj5jII+LxeBITE7u7uzUajdlsRgjh8ROSoaGhQa/X9/T0cA4US5diE3Pu3Ll58+YhqoY+2xxRVbrCZNPhcAQFBZF0QWG91ZBSNL+DSewwPmjFlovefyjn46jUnSNyR0cHuSATC8aCHWZ051WNGfKADsRxOHny5K+//mqxWBwOR3FxcVpa2hdffMEwzKRJk2JjY3Ee+qzlrKyspqYmq9WanZ0dHh6enJzc3Nzc1NSUlZUlJcOIh7PxKjMft9stk8kuX74sl/9PZJnsf0+/nE6nTCZzOp1eqSdxhrHJZPLZJr+Bdu3aJVaL3NzcgoKC2tpahUJht9sNBgOloEmTJkn36vbt22az+aeffpKSOTo6mpNy584d8ruhocFgMLjd7sHBwZdeeolhmPT0dKPRiPf+8ccfhYWF58+fj4qKYlsQS6fbHBoaMplMZIarXq93OBwMtSf4bBPjlao+45uGgvA7GP+ZCoZSNYo/dLnEoJyPo1h36UjpMBMJegjy7T6GYY2VNTQ04LEyDiaTiT/lw+PxqNVqclPJ2UQItba2pqSk5OTknDt3DiFUU1NjNBpjYmLIbRA9w4iHs6FkZtedcxve0NBAJFKpVPxbfpfLFRMTc+rUqcjIyLa2Nn65glejfCn8Hyvj22RDGkiwFt3d3XK5nJ1Z7D4GIaTRaEwmk1gdEe8q2+PxcLyiiCw2VobJzMzs6urCI5w4xWq1kqvFWbNmnThxguOtWPqINt1ut1wuJ0MZjY2NZExMUEM/bdJVlXgfg4W12Ww4nTNWRvdNTCuJc6twB5PYYST6IyYXpf/Qz8dRqTtlrEysjQQ7zAS9j/E9xvT398vl8o6ODs4mjjHLly+32+0WiyU5ORk/829razMYDBcuXOjp6enq6iooKMjOziaW8dAnHkIliZxNjEaj0Wg0OL/dbg8LC0tOTpaegb6XM1gslpkjC36cSOpLJCosLExNTcVXbfv27du9ezdCaMuWLW+//TZCqKKiIiMjg1+04D8FXwr/YwzHplgDCdYCi1NTU+NyuTo6OnJzcykxZs+ePSkpKfgR7tatWzlPp5HQWBn/sZCYyBRMJtOaNWsQQoODgyqVqrGx0eVyYWc8Hk9mZqbRaHSzQAiJpUuxiRDKzs7G4/UmkykxMbGmpgYfJaahPzbpqkqMMQih5cuX5+bm2mw2i8XCfubvs4YIIYPBsGrVKvIoG78jItjBJHYYiVpR5BLrP2Ln4+jWvaCgICcnh//MX6yNBDvMMxdjEELl5eVKpfLYsWPszaqqKpVKVVlZqdFoIiIi1qxZg580Dg4OlpeXJyQkBAUFaTSaVatWkSdspJSSkpJdu3YR+5xNTH5+/vLly8nm/PnzOXnoGSh7+U0olpmT0263L126VKVSJSQkHDhwgEjkdruLioq0Wq1SqczKyrJarZcvX1apVPh6yu1263S6L7/8EokHDDFlKIcIIhhjODbFGohfC5y/ubl5/vz5CoUiJiamuLiYEmM8Hs/777+vVqsVCkVubm5PT4/0f0COyEqlUq/Xs0WmUFBQYLFY8O+zZ8/OmTNHqVSmpaWZzWZ8JcSG+C+YLsUmQqi7uzsvLy8iIkKr1VZUVJCjxDT0xyZdVekKO53O7OxslUql0+kqKyul15eiVXd3d35+fmRkZFxcXGlpKZ5QI9jBJHYYiVpR5BI8ScXOx1Gve39//6ZNm9RqtVarLS8vp0+OEOswT2eM8QF/hEhISPj555/FNp9lAiHFxJVXMAgB/tPe3s6fjwAA/jCmz/xH5Nq1a5TNZ5lASAHyAhxMJpNer3/SXgBPFRN5usI44OrVq++99x7+/fjx408//fSvv/56si494wi2wtDQ0Lvvvvv3338/Ka/GM5988smRI0fu3Lnzyy+/7Nq1q7Cw8El7BDxVQIzxi3Xr1ul0Ovx70qRJw8PDYnMxgbFBsBUmT54cFBQETSNIRkZGTU2NVqtdtWqV0Whcu3btk/YIeLoI3DDcgQMHIiMjtVrt2bNncYrgPOb29naDwRAWFqbRaDZs2ECm/bEZP+PveGIJ/o0XM2bPO/J4PPPmzWM/5Dh//nxYWBj7oSV+6QQhdP/+faPROHPmTIVCkZCQUFlZiZ8EiqUjoSfSDMMcPHiQs0sulyclJZGX5ClwDGq1WvyU0ul0qlQq9lTO+vp6PAvTW1NS9iKEqqur9Xp9UFBQcnIynixODuQ/3qO7x28FhNCVK1fwi29oVHsmAAB0AhVjxnIt7rHEq9lcmKysLLI21JkzZ+Li4vAqEXjOaHt7e3d3d1NTU0ZGBl6bSyydlOj+f9hzVHBKd3f3qVOn1Go1+Q+lVwcfNTAwYLFY0tLS8GzLoqIiPHETM3fuXDKB0FtT/L1ms5m97Hl1dbVOp2tqauru7j5x4kRkZCSZriomsm/uodHumQAA0AlUjGFPlg30WtxjiQ8xpr29XalUWq1Wj8eTkJCA/woHBgbkcjn/0lgsfcQS+btqa2uzsrKkVwfT2to6Z84chJDD4VCpVPjtvHPnzun1espNDN2U4N6WlhayNy4ujr0m6cGDB8m7U2JV9tm90e2ZAADQkfQdTM5q0vx1qvnZVIFZixsXxP9wgFd+jrjguVgpnC8a0KUjzJ49e9OmTaWlpYcPHw4LC8Pj3cPDw3hQi5NZLN0HUlJSLBaLt0cFBQUNDg4yDBMbG7tu3bp9+/YxDFNZWVlaWurtyiXElCAKhcLtdjMMc+/ePYfDkZ6eTnYtXry4ra2Nbtxn9/zsmWJfOgAAQBh6CLIJrSbNX6daMFsg1uImiwhwPhzglZ8jLnguVgryckV9Ql9fn1qtjoiIaG1tJYk5OTnZ2dktLS1kgVV6OvLyPkbKzR/nqL6+vqysLPLAyW63R0RENDQ0zJw5c8SPmNFNcfa6XK7s7Gy8krndbmevV4gQ6uzsJAt6Uqrss3v+9EyxVfoBABBEUoxhryYtuPYOPxtm1Nfitol8OMArP0dc8FysFOTTWBkmLy9v5syZ7JT79++XlpYmJCTI5fJZs2aRt3/F0olj7JWVt27dKuaMxBhDDEZGRspkMoPBwM5QWFioUCjIghw+m+J4HhQUlJ+fj4Mo33OyJJTgXp/dY9vxuWdK+dIBAAAEr7+1LLhONf2PYBTX4raJfDjANz/FFtgQKwX5GmPMZnNERAT74x9s3G53a2sr/9Pf/HSbzaZUKtnrPwp+TkawdoJwDDY3N8+bNw9PVCOe40GtEetIN8Xee+zYsZiYGBLafb6P8dY9wTVLvOqZUlbpBwCAzVi8HyO4PjZegn5oaOjSpUskp8S1uCccRqOxuLj40KFDZWVld+/e5ewNDg5euHBhdXX16dOnR0yXyWTTWVA+OdzX1xcWFjaib2yDixYtqq6urqmpIXvDwsLkcnlwcLCUatJNkb1r165Vq9V1dXU4HY89Dg0NkZz379+X4rm37vHxtmeSRddNJpPJZDKbzV59SQEAnkG8jjEajSYoKOj69et4s729nbyEKEZtbW1RUdHw8DB+oM0wDPk9PDyclpZG/nY7OjpmzpyJS2EY5ubNmySdWHO73ex0nH9U/GQjsRQpfP3111artaSk5NVXX01PT//www9xOvmgOinR4/FQ0r3l4sWLSUlJ3h6FPw/lQ3FemSorK9u3b9+jR48YhgkPD4+Li2tpaSF7W1paEhMTR8UHOt72zNjYWKVS2dfXR0Ip+e4RAADC0G9zBEcY+OtUUwY0RnctbpvIhwN885MyViZYCvr/Lxp0dXVxBnn4DAwM6HS6+vp6vNnR0aFUKs1mM1588PDhww6Hw+Vy4RH/PXv2iKWzm2PE92N6enp8eD/G7Xa3tbUtXryYfFRcTFgfTPHtJCYmkpFD8n4M9pz/foxglb1yr7OzU/qq9TiDYM+kr9IPAAAHX2IMf51qyqk+umtx44L4Hw7wzU9KjBEsBUO+aOB2uxUKBfmCjiC7d+/mPBYuKirCn6k4d+5cRkZGWFiYUqmcO3fu4cOHcQaxdOTNe/6JiYk+vOev0Wg2bdpEXgoRE9YHU3w79fX1Op2OzAejvOfPrzIJTtLd++qrr+bOnctO8a1n0lfpBwCAw3MIIf9uhMaUGzduJCUl/fPPP+OklG3btlkslu+//z6g/gB+8ujRozlz5pSVlW3cuPFJ+wIAzxbja23/CceBAwfgqe/4Jzg4uL6+/pVXXnnSjgDAMwfEGL+YPHnyggULnrQXIxAdHS2YbrVa8XvsT8TUGAMBBgCeCBBjnn7E7rR8iAqjaAoAgGeBCfY8BgAAAJhAwDfKAAAAgEABMQYAAAAIFBBjAAAAgEABMQYAAAAIFBBjAAAAgEABMQYAAAAIFBBjAAAAgEABMQYAAAAIFBBjAAAAgEABMQYAAAAIFBBjAAAAgEABMQYAAAAIFBBjAAAAgEABMQYAAAAIFBBjAAAAgEDxXwrLyxZZZkDgAAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAeaklEQVR4nO2dfVBTZ/b4rxEhxBDkLQKivKxFh7KUVYaBbnz5Ok6laYZGxJdBWt2WQcdBpUxlEC1l0fqCL7OmkWUc21HHUdexbMbJOqyT2k5KGQYRUybGGFmEGALFEAmNbMgC+f3xTO/venPvzQ0QQD2fv+59eO55zjnPc3O4z03OmeVyuTAAAAAA8AGc6VYAAAAAeG2BGAMAAAD4CogxAAAAgK+AGAMAAAD4CogxAAAAgK+AGAMAAAD4CogxAAAAgK+AGAMAAAD4Ci9iTFdXV1BQ0PiGsdlsR48eHd+1kwJRgYkYQsmkC/Q4CpsRPfaZGrVZKuCtdSQ+++yzwMDAixcvjtsoXMI4rp04XV1dISEh0zI0rgDyG8mBk7VIpv0TAJgupug5ZmBg4MiRI1Mz1sxUYHKJjY21WCwzQchMUKC/v18mkzU1NeXn549PJlHCxPV5FfH1YnjNbkCAPX7TrQAwTgICAmaIkGlXwG6383i8d955Z9wySRLeTKZ9MQCvJeN5jnF/msYf8+/evbtixYqgoKAFCxZs2LDh4cOHGIbZbLa4uDi73T5r1izSXsSLFy927NgRERGxcOHCv/71r6Ojo7j8EydOzJ8/PyQkZNu2bf/9739R/+Hh4U8//TQoKCg2NvbLL78cHR1FnU+dOhUfHx8SErJ161abzUZSmFKBM2fOxMfHh4WFffTRR/gl7vJJou7evZuZmRkYGBgREbFx48bu7m78T8ePH3dXmNLAzZs3f/XVV/iFmZmZFy9e9Dg05RSwMR/DsAcPHoSFhf3000+UQljKIfaZO3fu5s2b+/v79+3bFxERERYW9pe//OXFixcMVs96GYz1PgyDzzEM6+/vJ04uyTNHjx6NiIiIior65ptvMJr5JUmgVP7Jkydz5869f/8+6h8SEvLDDz941JPZq93d3evWrQsKClqyZMmVK1dI0s6ePbtu3Tr89MCBA9u2baPzLcMtiVi/fv2JEyfQ8S+//BIQEIBrsmPHjn379nm7J9bT0/PBBx8EBQXFx8efOnUKH47SwwyfAJSTy3JVA68Ek7xXJpFItm/fbjQaGxoaRCIRl8vFMCw4OFiv1/P5fIfDQdqL2LNnj9lsbm1tra+vv3nzZk1NDWq32+3Nzc0tLS0tLS2tra3V1dWovaqqamhoqK2trb6+Xq1W19bWos5tbW2NjY3Nzc1Go7G8vJyklbsCdrtdo9GgS8xmc1lZGYN8Iq2trYWFhb29vVqtNiYmpqioCFe45XeIClMauGnTJoVCgTr09PRoNBqpVOpxaDo8mm+z2XJyco4dO7ZixYqJyMH91tDQoNFozGbz0qVLLRZLW1tbU1NTZ2cnfgml1Y7fKS0t3bJlC0vrMHqfI8LCwuhWl91u1+v1Wq32woULIpEIo5lfkgRK5ePj48vLy4uLizEMq6ioEIvF//d//8dGTwavFhUVCQQCnU5369Yt9xgjlUrVavVvv/2GTm/evJmTk0PnW49IJBKVSoWOlUrl2NhYfX09OlWpVGKxmI0QIkVFRf7+/u3t7SqV6tKlS3g7pYcZPgEYbiiPqxF4NXCxprOzk8/nEw/w9nnz5rlcLqvV6ufn53A4GK4lMjIywufzOzo60OnNmzczMjJQZwzDjEYjaq+rq0tLS0PH4eHhdrsdHWs0mvT0dNR5cHAQNTY0NCQkJDArQLqksbERv8RdPoND2tvbIyMjGRSmM3BoaEggEKD+NTU12dnZbIYmmYDPBZ35eB+xWLxr1y6vfELpRtRnYGAA78PhcIaGhnA3Ll68mMFqhFarXbRokcViobPIRbNaELjPWXrGarUSe9I5Gb+KQXmn07l06dLKysrw8PDe3l5K9Uh6Mnh1ZGSEy+US1wy6iYhkZGTcuHEDV8/hcDDcMpS3JI7ZbObxeOjeTE9PLykpycvLQz0FAoHT6WS4uynvXC6Xi6tBVN6jhz06zcVuNQKvCpP5PiYkJCQ3NzcjI2PNmjXR0dFpaWmrVq1i6N/X1+d0OuPj49Hp0qVL0drCMIzL5S5cuBBvNxqNGIY9f/7cYrHExcWh9rGxMT8/PwzD+Hw+/pgfExNjtVo9qkq8JDo6Gl1CJ5/I/fv3S0tLdTqd0+kcGxsbGxtjUJjOwMDAQLFYrFAodu/eXVdXt337djZDs7HF3fwDBw7U19efP39+gnLwPsHBwXgfgUAQGBiITqOjo9FLY4ZpxTCssLBQJpOFhYWxtA6j9zkbi4hbRmyczKD8nDlz5HL52rVrZTLZ/PnzWepJ59W+vj4Mw4hrxl2gVCpVKpUbNmxQKpVisTggIKCnp4fBtwxERUUlJiY2NjYmJSWZzeaKiorExMTR0VGVSrV27do5c+awEYLT19c3NjZGVAMdjGMZ003uOG5qYGbiRYxxOp0eV8zVq1fv3bun1WrNZnNJScm777779ddfT0zD/4/D4eBwOC0tLbgaHA7H6XT6VD6pj1QqLSgoqK2t5XK5JpMpKytrfGNt2rRJLpfn5+c3NzfX1dXZ7XaPQ4+DoaGhurq6a9euFRUV5eTk4OFhujh79mxCQsKHH37o1VWT5XM288tMb28vh8Pp7e31qZ44OTk5aItPqVRu3759gtLEYrFKpero6JBIJMHBwampqWq1enwbZXSMw8OT7jRgpuHFPabT6RISEjAMCw0NHRoawneKTSYTsdvy5cu3bdu2f//+b7/9Fn/rQIlQKPT393/y5Ak61ev1+H9ADofj6dOn6NhgMCxatAjDsKioKB6PZ7VaF/xOVFQUe/094lH+s2fPzGbzF1988Yc//GHBggXobRODwgwGisVijUZz6dKltWvXBgUF+cg0DodTV1e3cePG9PT0gwcPTlwgG+is7u7ulsvlMpnMK2kMPvcWNk5mmDKbzfb5559fuXKltrYWfZllInoKhUIMw4hrxr3PW2+9JRQKv//++6amJhQJ6NRjviUR6JXMzZs3s7OzMQyTSqUKheLHH38cR4wRCoUcDqerqwtXAx14u4wncXKBmQvzVtrt27fPnz9vsViam5uXLl1aW1uL2tPT0wsKCnp7ew0Gg0gkQruxOp0uKyvrzp07FovFaDQWFBRIJBLU3263+/n5GQwGkvyCgoLs7Gyj0ajVapctWyaTyVy/78bm5uaaTCatVpuamlpZWYn679y5MyMjAz0nVVdXV1VVedyJdleA4RJ3+SQ5QqGwpqZmYGDAYDBIpVJ0IYPClAYi8vLyBALB9evXWQ49ODjo5+en1+tHRkY8vhsj/Umv13O53La2NqJAhlcglG5k7kM8pbQ6Jyfnxo0b+Jt/kkCidcRjOp97NITyBQCdk4md6aZs165dmzZtcrlchw8fXr16tcsNdz2ZPSaVSolrhnLdVlRUpKSk4PcRg3qUt6S7hkKhEDnfZDIJBILU1FSSB0jOJ53i5ObmSqXSzs5OrVabkpLi8Q6i+wSgu6HY3NTAK4GHGNPU1CQSifh8/uLFi0+fPo23t7e3r1mzhs/nJyUlyWQytAKcTmdlZWViYqK/v79QKMzPzye+Gq2srOTxeBcuXCDKt9vthYWF4eHhMTExlZWVaB2jFXbs2DGhUDhv3ryPP/4Yf7HscDiKi4tjYmJ4PJ5YLO7o6GC/HHEFGC5xl08Solar09LSuFxuZGRkSUkJ8Zaorq52V5jSQIRCoeDz+QymuZtQVlZGMoFljHG5XHv27Fm5ciVRmu9iDKXV7v/ckATi1pGOKX3u0RDKGEPnZGJnSuVbWlr4fD56Re9wOOLi4i5dukQS7q4ns8dMJtN7773H5/MTExNPnjxJuW41Gg2GYcS7hm5FUd6SJPLy8nJzc/HTtLS08vJydw8Qne9+iujt7ZVIJHw+Py4u7tixY2zuIMpPAIYbis5vwKvFLJfbzT/tdHV1JScn4w/+APDG8uLFi/DwcLPZPL2ZZph59OjRypUrf/311+lWBJiJQE5MAJi53L59WyQSzeQAg2GYRqNBb2oBwB3IJQMAMxSbzSaXy736veqUcejQoejo6Ozs7I6OjvLy8oqKiunWCJihwHMMAMxQ8Nd7060IBatXr66pqYmJiUGZEVCeGwBwx0OM+fe//x0cHNzf34+3/PnPfz5w4ACGYb/99tvevXtjY2MDAwOXLFly/PhxlJuIrp09sbGxLF/GuCdZImZq6urqwrNjzZ49Oz4+/tChQ94qAwDTxfDw8HfffTczU1WuWLHi3r17w8PDjx8/3rt373SrA8xcPMSYdevWiUSiqqoqdPrPf/4TT0v1ySefGI3G27dvG43Gmpqa+vr61tZWhvZpAWXgcDgcdrtdoVAolUpIMA4AADBleP5e2aNHj5YtW4bSTCUlJZWXl6O8wgKBwGKxkH46TtfuI9y/gdbV1ZWamvr8+XPKv/7888+FhYUPHjyYAt0AAAAAz+9jlixZUlhYWFZWdu7cOYFAgDZeUVoh99QydO1EGFL3e5vq31u4XO7IyMj4rgUAAAC8hdU7/4qKijt37pSXl+OJQObOnSsWi7ds2fLzzz/jVUMY2knQpe73NtW/Vzx79uzgwYNSqXQc1wIAAADjgeVvNbds2bJo0SJiy+DgYFlZWWJiop+f3+LFi/GfHNO143ibCZ8h1b/7b7lJP3THMCw8PDw8PDw0NJTL5e7cuZOy9AAAAADgC1jFmLa2tnnz5iUnJ+P5yog4HI7GxsaMjIyDBw+yae/s7ORyufipTqcTCoUul8tsNvv7++PtBoMBLyZB2d/FIsbweDyTyWQymcxmMynUAQAAAL6G1V7Znj17SkpK5HL5wYMH0et0IgEBAZmZmTKZ7Pr162zaJxFUdon4dWRUmB0/5XA4eP7X2bNn+0gNAAAAgBLPMea7777r6Oj4/PPPV61aJRKJ8B/0kl63oCJ9DO2kRq8y4VP2xzAsIiIiNDS0qakJl6xWq1NSUjwaBQAAAEwFzI85Q0NDcXFxly9fRqcGg4HH47W1ten1eqFQeO7cObPZPDAwoFark5OTjxw5QtdOlOltJnyG/i6XSy6XJyYmqtVqi8Vy48aN0NDQhoYGfCCP5V0BAAAA3+EhxlRVVZEKyxcXF6PiGbdu3Vq9erVAIODxeCkpKefOnUMd6NpxGFL3e5vqH3H69Om4uDh/f//k5OS6ujrSQOPxCgAAADAZTENuf29T90OqfwAAgFcUyIkJAAAA+AqIMQAAAICvgBgDAAAA+Aq2MebZs2dz5sz56aef0Kl7Un32EFP322y2o0ePTlwmzqQIIUqbRWDhwoX79+//3//+N1nyZwKT6zEGiHM99RCncs6cOX/84x//8Y9/jFsUpcd858kpmyNmHVDVjElU5rPPPgsMDLx48eKkSANmJmxjzLVr1/h8/pUrVyZ3+IGBAY/J9mNjYy0WC0uBXnVmA14dYGhoqL6+Xq1W45UOAK9gM9c+BZ9Ks9l88ODBoqKif/3rX9OozyvKZN1i/f39MpmsqakpPz9/4tKAGQvbGHPlyhW5XK5QKKblv3ivyjRNek2ngICAgICAwMDAt99+++TJkzdu3Jhc+cCUgaYyIiJi8+bNhw8fxpOuAl4xKbcYSsnxzjvvQAKO1xtWMeY///mPyWTaunXrsmXLbt26Rdnn7t27K1asCAoKWrBgwYYNGx4+fIjR5OrHsdlscXFxdrt91qxZ+PPymTNn4uPjw8LCPvroI5vNhrk9m1MOhEPszNwTdcjMzAwMDIyIiNi4cWN3d7dHV/j7+zudTgzDzp49u27dOrz9wIED27ZtYyhDQDcWpZLMmlMOTeltkuuIRUJJuLudTufNmzd/9dVX+IWZmZlo7oaHhz/99NOgoKDY2Ngvv/zS41wzrw1f2EgiPT1dq9WiY4aiEnSSjx8/zlxsgtkhDPJR+9GjRyMiIqKior755hsGK9xHQZefOnUqPj4+JCRk69at+IRiGDY6Orp///758+fPnTt348aNqMQt3Vx0d3evW7cuKChoyZIl+B4GrjbzQD09PR988EFQUFB8fPypU6dIk9Lf3+9xPXjlB2DGwirGXL58OS8vD8Ow/Px8uu0yiUSyfft2o9HY0NAgEom4XC5Gn6sfERwcrNfr0Q4Gel622+0ajaaxsbG5udlsNpeVlbEciL1KRFpbWwsLC3t7e7VabUxMTFFREbMfnj9/XlFRUVBQgGGYVCpVq9X4i6WbN2/m5ORg9GUI6MaiVJJZc7qhmb3NAJ3bKXXetGmTQqFAHXp6ejQaDSqXUFVVNTQ01NbWhnYUa2triUO4zzWztpNuozuhoaGDg4Po2Fuxdru95Xfoik0wO8SjfL1er9VqL1y4IBKJGHpSjmK329va2tCEGo1GVLgWUV1drVKpVCqVwWCIjo7W6XQM5hcVFQkEAp1Od+vWLcobn2GgoqIif3//9vZ2lUp16dIl0oVhYWFs1gN7PwAzFzY/1ExMTNRqtS6Xa2hoSCgUDg4Okn5Cb7Va/fz8SGnz6XL1EyHKQTljBgcH0WljY2NCQgKpD+VAlAI99iTR3t6O0jyTpGGE6gAcDicrKwv/a0ZGxo0bN/BBHQ4HQxkCyrEolWSjufvQlN4mTRMxKTXJRne30+k8NDQkEAiQjTU1NdnZ2ahDeHi43W5HxxqNhpQewvXyPLJZG5Noo4sxRTdDUQlKyXSzTOrvlUPc5VutVgblGUYhTWhDQwNxQoVCYWtrK1ECnfkjIyNcLpdoJq4eUoZhIHQtLhO/ls58upkl+QF4FWEqWIm4e/cun89/++23MQwLDAzMysqqq6tbvXo1sU9ISEhubm5GRsaaNWuio6PT0tJWrVrV19fndDrj4+NRn6VLl6JFwwCfz8d3D6Kjo61WK6kD5UCUotj0vH//fmlpqU6nczqdY2NjqIgnCR6Pp9Fo0HFHR0dxcfGZM2f27t2LYZhUKlUqlRs2bFAqlWKxGG1Sc7nchQsX4iYbjUaGsSiVZKO5+9A9PT3eehuHzu2UOgcGBorFYoVCsXv37rq6uu3bt2MY9vz5c4vFgucwHRsbY66FymZtTK6NE1SGBN0s43jrEBJ8Pp/Njh/dKMQJjYmJwSfUZrNZrVZS0lg68/v6+jAMI5pJqSflQH19fWNjY0SZzIbQ6cDSD8BMxvO6v3z5sk6ni4iIQKfoazmkGINh2NWrV+/du6fVas1mc0lJybvvvkt8cJ5E3Af6+uuvx9dTKpUWFBTU1tZyuVyTyZSVleUuBFUHQMcLFiyQyWSffPIJijE5OTno+V2pVKKPWgboxqJU0qPmXg09buh03rRpk1wuz8/Pb25urqurwzDM4XBwOJyWlhb8k5TDmehPr3xto9VqFQgEky4W4QuHsBwFvS9kAN6xA1MK82POyMhIZGRkc3Oz6XeMRuO8efOam5sZ0k1qNJqYmJhx7JXRbR3QjYUGohPI3LOvr8/Pz4/YgflxHtHU1ETceUhOTlapVPPmzUM7BqRdFIVCgXZR2IxFqSRdo/vQlN4eHBzkcDjE3QyPNuJuZ9DZ4XCEhob+7W9/y8nJwTvw+XzSJgzDQGzWxiTa6G6my+Wqra0Vi8UMytBJpptl0hAeHcIg331bj+4WcB+FefNQKBRqNBpif5Z7ZQqFwn2vjG4gdG1nZyc6HfdeGeS0fQ3wEGPq6+uTkpJIjbm5uUePHvXz89Pr9Sg1sk6ny8rKunPnjsViMRqNBQUFEonERZOrn4jdbvfz8zMYDC52MYZuIOJVqLPHni6XSygU1tTUDAwMGAwGqVRKdxs4fken061cuXLXrl14h4qKipSUFFwyQxkCyrEolWSjufvQdN5OT08vKCjo7e01GAwikYh9jGH2T15enkAguH79Ot6yc+fOjIwM9OxVXV1dVVVFGog413Ta+shG18tTabFYrl27Fh4erlQqmZWhlEw3y4ODg8SbwqNDGOSTPltJkom4j8IcY44cOZKent7W1mYymYqKitRqNYP5UqmUaCb7GONyuXJzc6VSaWdnp1arTUlJ8bjw3HWAGPN64CHGfPzxx6WlpaTGb7/9dtmyZWVlZTwe78KFCy6Xy+l0VlZWJiYm+vv7C4XC/Pz83t5eF02ufhKVlZVIDpsYQzcQ8SrU2WNPl8ulVqvT0tK4XG5kZGRJSQnd+3AcoVBYWFiI/+PpcrnQqxrkBHx0yjIElGNRKslGc/eh6bzd3t6+Zs0aPp+flJQkk8m8ijEM/lEoFHw+n1hkweFwFBcXx8TE8Hg8sViM/09KBJ9rOm19ZKPr5an08/NLSkq6du0as1g6ychj1dXV7rNMvCnYOIRBPqknUTIR91GYP/pHRkZKS0vDw8O5XK5UKrVYLAzmm0ym9957j8/nJyYmnjx50qsY09vbK5FI+Hx+XFzcsWPHPC48dx0gxrweTENu/9eJFy9ehIeHm81m/JcNU1aGgDT0a8mbYOObwKNHj1auXPnrr79OtyLANAA5MSfE7du3RSLRtHwCTuPQU8abYOObgEajSUhImG4tgOnBi+9TAiRsNptcLt+yZcsbNfSU8SbY+Bpz6NCh6Ojo7Ozsjo6O8vLyioqK6dYImB7gOWb84Nvxb9TQU8abYONrzOrVq2tqamJiYvLz8/fs2YNSAQFvIPA+BgAAAPAVHp5jZkLhiklUY9LL1YwDupoZqP306dO4VkQNSdoy12IZt2m42Bky7wAAvOp4eI6Zyi9KMTM8PDzxjOJEc6bFtP7+fpQwKjk5mfhza2L7yMgIspRBW4/Kj89dRLGT4nAAAN5wXpl3/q/H5x1eM4OhfVJSfUzcXa+HwwEAmF5YvfN3L5XhXt5jw4YNviudwqZkBXO9Cox1uRrMU+WP9evXnzhxAh3/8ssvAQEB+IU7duzYt28fncnuNTMQxHbiXhkdJEPcy2wQd7pmvQzDjBDFktRgKK9CVz4EAAAAYxNjKEtluJf3eP/996egdApGX7KCuV4F5k25GubKHxKJRKVSoWOlUjk2NlZfX49OVSqVWCymM9m9ZgaC2L5+/XqPM0JpCF2ZDTwRTmlpKf49YEr1iGJJatDVF2EoHwIAAIBhnnJiMhREIZX3MBgMdD2JjK90iseSFWzqVbheTl/BUDeFufKH2Wzm8XhIyfT09JKSkry8PCRQIBA4nU46k100aUJcNPk5mBOGkgxhLjei1WoXLVqEEoewUY9N/krmOiUAAAAuNvVj6EplkMp7+Pv7T03pFMqSFd7Wq3AXhddN8Vj5IyoqKjExsbGxMSkpyWw2V1RUJCYmjo6OqlSqtWvXzpkzh85k3+GxzEZhYaFMJgsLC0OnXqnHUF6FrnwIAAAAYvy/wczJybl16xaGYUqlEtXBpUMqla5cuVKtVms0GnQJ4urVq+fPn09JSXE6nSUlJbt376ZrnErwmhwajUaj0bS1teE1ynDEYrFKpVIqlRKJJDg4ODU1Va1W4xtlGL3J08LZs2cTEhI+/PBDvGVGqQcAwGuM5+cYh8Px9OlT9IBiMBgWLVqE2t966y2hUPj99983NTVdv37darVS9nz27JnZbP7iiy/QVRaLhSh8+fLly5cvxzBMLBZLJBJUiYuykRmhUMjhcLq6umJjYzEM0+v1XvjgZaKiong8ntVq/dOf/kTXRyKRFBcXR0ZG7ty5E8MwqVSqUCh+/PHH06dPezR5iunu7pbL5Y2NjXiLt+oJhUJ/f/8nT56gRxm9Xo8/5AEAADDD6jmmpKSku7v7wYMHlZWVEokEb8/JySkpKRGJRPiGiXvPiIiI0NDQv//97zab7fHjx5WVlajnw4cP33///R9++KG/v//p06dyuTw1NZWykY2Gs2fPRp/7XV1daHTKbuHh4Q6H4/Hjx8zS8vPzd+3a9eDBg56enhMnThw6dIjUITMzs7Ozs6mpac2aNRiGZWdnX7hwITIyMioqisFkbwkNDXU4HI8ePRodHSUeszcEw7A9e/YcPnyYx+MNDw8PDw8zq0cpdvbs2Vu2bCkuLn769CnybV5eHvOgaCAAAADP7/zpSmW4Xi7v4dPSKWxKVnisV4HwWK7Gxa7yR15eXm5uLn6alpZWXl6On9JVXvHqnb/r5aohpAoidIaQhFBON0NhGCT21KlTzLU93FVlU7cUAIA3jQnlKyOW95g5GQEwqFcBAAAwM5hQ3uUZW94D6lUAAADMBMafS2amlfeAehUAAAAzjfE/x8y08h5QrwIAAGCmAfVjAAAAAF8BdTABAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAV/w9G4rAvtYz7vwAAAABJRU5ErkJggg==)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 16 March, 2020 05:27 GMT
Vulnerability Verified: 16 March, 2020 07:20 GMT
Website Operator Notified: 16 March, 2020 07:20 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 16 March, 2020 07:20 GMT
Vulnerability Fixed: 16 March, 2020 07:55 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 15 April, 2020 05:27 GMT