muktopaath.gov.bd Improper Access Control vulnerability OBB-2042532

2021-06-0723:47:00

geeknik

www.openbugbounty.org

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

a. verified the vulnerability and confirmed its existence;
b. notified the website operator about its existence.

Affected Website:	muktopaath.gov.bd
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	IAC (Improper Access Control) / CWE-284
CVSSv3 Score:	6.5 [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	geeknik
Remediation Guide:	OWASP Access Control Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

http: //muktopaath.gov.bd:80/.env

Screenshot: muktopaath.gov.bd vulnerability

Mirror: Click here to view the mirror

Vulnerability Reported:	7 June, 2021 23:47 GMT
Vulnerability Verified:	8 June, 2021 00:00 GMT
Website Operator Notified:	8 June, 2021 00:00 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
x. Using Twitter notification
Public Report Published [without technical details]:	8 June, 2021 00:00 GMT
Vulnerability Fixed:	20 May, 2022 15:58 GMT
—	—