Idor - Access To Private Resumes

Summary by Indeed

An authorization flaw in the application was identified, where an endpoint for downloading the pdf of a 'public' resume could also be used to download a resume that was set to 'private' if you had a method to enumerate user resume ids.

Summary by mar0uane

Idor Based in the url of the resume , all what attacker should do is adding /pdf/ to url to bypass it and see private resumes .

Activity