Lucene search
K

CompTIA Information Disclosure

🗓️ 01 Oct 2016 00:00:00Reported by CISSP WannabeType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 52 Views

CompTIA Security+ certificate account update issue with support ticket system vulnerabilit

Code
`I was signed up CompTIA account with a fake name for a privacy reason. Later on, I wanted to update my name in CompTIA account because I was planning to take their Security+ certificate. The problem is I cannot update my name directly from the profile menu, it told me to create a support ticket (this is a good idea I guess).A However, the support guy asked me to upload a copy of a legal ID (driver's license or passport) to the support ticket system.  
  
The real bad thing is the CompTIA's support ticket system can be logged in by using just an "email address".A If you know email of someone who holds a CompTIA certificate, you can freely access his/her support tickets at:  
  
http://newsupport.comptia.org/ics/support/mylogin.asp  
  
You can fill anything inA 'first name' field. Only a valid email address is required to access anybody support ticket.  
  
So I tried to explain to them that this is not a good security practice to ask me to upload my passport to such an insecure system but the support guy cannot do anything about it.  
  
I think the Security+ certificate creators need to learn how to secure a system containing sensitive information like the copy of customer's passports with at least a pair of username and password.  
  
rgds,  
CISSP wannabe  
  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation