{"id":"cbd0ed85-67d6-40c9-8805-dfe11889abb0","engagementId":"a8797d7d-bdf5-4dad-802e-414f71e5855c","data":{"brief":{"id":"4d351768-8738-467e-a7b2-1e6aa531b25d","name":"Blackbaud Vulnerability Disclosure Program","tagline":"We work as One, We bring heart, We invent possibilities, We expect the best, We give back.","description":"\u003cp\u003eBlackbaud and our Cyber Security program is committed to the security of our systems, products, and our customer information. We appreciate the valuable contributions of the Cyber Security community.\u003c/p\u003e\n\n\u003cp\u003eIn order to work with us better, we'd like to share a few guidelines on reporting vulnerabilities to us. We expect that each security researcher aligns with our core values throughout their engagement with us. This will help facilitate a collaborative working environment and instills trust in all participants of the engagement. The Blackbaud core values are: We work as One, We bring heart, We invent possibilities, We expect the best, We give back.\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases, a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Blackbaud not listed in the targets section is out of scope. This includes any and all subdomains not listed above.  If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Blackbaud, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable.'\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eAccess\u003c/h1\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eTo access \u003ca href=\"https://bugcrowdninja.yourcauseuat.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://bugcrowdninja.yourcauseuat.com/\u003c/a\u003e, please register for an account using your  @bugcrowdninja.com email address using this URL \u003ca href=\"https://bugcrowdninja.yourcauseuat.com/auth/domain/getstarted\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://bugcrowdninja.yourcauseuat.com/auth/domain/getstarted\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eGuidelines\u003c/h2\u003e\n\n\u003col\u003e\n\u003cli\u003e\u003cp\u003eIf you are able to find compromised credentials or any other credentials tied to Blackbaud products/environments/customers/sites, we request the researchers to refrain from testing/using the credentials and report the credentials to Blackbaud through the VDP program and protect the privacy of our customers and data.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAny authentication/authorization bypass vulnerabilities  discovered that provide access to the site/products should be disclosed immediately and not be leveraged for further testing.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePlease limit traffic to 6 requests per second or less. We are always excited to see new and novel techniques that you’ve developed and if you can use it to exploit our systems but ask that you do so responsibly with targeted intent so we can deliver our services without interruption!\u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAre you able to retrieve any PII from other users?\u003c/li\u003e\n\u003cli\u003eSSO Bypass \u003c/li\u003e\n\u003cli\u003eAuthorization Issues\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not engage in any activity that can potentially or actually cause harm to Blackbaud, our customers, or our employees.\u003c/li\u003e\n\u003cli\u003eDo not engage in any activity that can potentially or actually stop or degrade Blackbaud services or assets.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003col\u003e\n\u003cli\u003e Denial of Service attacks on Blackbaud Infrastructure and Applications using automated tools.\u003c/li\u003e\n\u003cli\u003e Spam (including issues related to SPF/DKIM/DMARC).\u003c/li\u003e\n\u003cli\u003e Scanner output or scanner-generated reports, including any automated or active exploit tool.\u003c/li\u003e\n\u003cli\u003e Use of third party libraries with known vulnerabilities. PoC demonstrating exploitation is required for this to be considered.\u003c/li\u003e\n\u003cli\u003e Fingerprinting, information disclosure via Server Response Headers.\u003c/li\u003e\n\u003cli\u003e TLS/SSL Protocols and Cipher issues\u003c/li\u003e\n\u003cli\u003e Missing Security Headers (like CSP, X-XSS-Protection, X-Frame-Options etc) and cookie Flags (on insensitive cookies that do not relate to authentication/session).\u003c/li\u003e\n\u003cli\u003eWeak Password Policies.\u003c/li\u003e\n\u003cli\u003eClickjacking on pages with no sensitive actions.\u003c/li\u003e\n\u003cli\u003eHost Header Poisoning that does not prove any significant security impact.\u003c/li\u003e\n\u003cli\u003eLack of Multi Factor Authentication, Captcha/re-Captcha.\u003c/li\u003e\n\u003cli\u003eHTTP methods/verbs enabled. (Would be a valid submission if the insecure use of a verb can be proven)\u003c/li\u003e\n\u003cli\u003eSelf-XSS that cannot be used to exploit other users (this includes having a user paste JavaScript into the browser console).\u003c/li\u003e\n\u003cli\u003eUnauthenticated/logout/login CSRF.\u003c/li\u003e\n\u003cli\u003eSub-domain takeovers without valid PoCs.\u003c/li\u003e\n\u003cli\u003eAny other submissions determined to be low risk, based on unlikely or theoretical attack vectors (timing attacks etc, unless exploited), requiring significant and unlikely user interactions, or resulting in minimal impact or any other best practice concerns.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"c2813abc-8f99-4816-b79e-6c7979294e7d","name":"In scope targets","targets":[{"id":"0de3003c-2f94-4e6a-9ab1-dd6c758a495a","uri":"","name":"https://*.blackbaud.com/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1ec504d3-e4ba-4d43-9ae9-ba8a5ca3819c","sortOrder":0},"sortOrder":0,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"0de3003c-2f94-4e6a-9ab1-dd6c758a495a"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"0de3003c-2f94-4e6a-9ab1-dd6c758a495a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0de3003c-2f94-4e6a-9ab1-dd6c758a495a"}],"recentChangeFlags":null},{"id":"11292083-1807-47b2-aa32-21ebae9fcd9f","uri":null,"name":"https://*.blackbaudhosting.com/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fa70cc94-aed3-4ded-b091-4a56990801e8","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"11292083-1807-47b2-aa32-21ebae9fcd9f"}],"recentChangeFlags":null},{"id":"b4bb65ce-2475-4ce4-943d-54253abbfa1b","uri":"","name":"https://*.justgiving.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"39c74eca-8f41-4fde-9766-14e70f321bd4","sortOrder":2},"sortOrder":2,"tags":[{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"b4bb65ce-2475-4ce4-943d-54253abbfa1b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b4bb65ce-2475-4ce4-943d-54253abbfa1b"}],"recentChangeFlags":null},{"id":"5936746c-3736-463e-babd-b0b0fe5aa1a7","uri":"","name":"https://*.blackbaud.net/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9ab9175c-cfa9-4fad-a9da-8f01d841897c","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5936746c-3736-463e-babd-b0b0fe5aa1a7"}],"recentChangeFlags":null},{"id":"3441fc5b-8e99-4f18-bf93-10ef2671f9be","uri":"","name":"https://*.blackbaudondemand.com/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7439e2cc-51cf-4bd7-ad81-9ad38b548581","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3441fc5b-8e99-4f18-bf93-10ef2671f9be"}],"recentChangeFlags":null},{"id":"9f8cfaa7-5360-4690-a40e-a543ef6feb73","uri":"","name":"https://*.myschoolapp.com/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fbdd8a0e-68b5-444b-85f2-ad8ee18f7459","sortOrder":5},"sortOrder":5,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"9f8cfaa7-5360-4690-a40e-a543ef6feb73"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9f8cfaa7-5360-4690-a40e-a543ef6feb73"}],"recentChangeFlags":null},{"id":"e868ab60-ad86-4b11-8dfe-370df45dc65f","uri":"","name":"https://*.mycampus-app.com/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"34a514fb-7ba1-44f8-bffc-57de1a9c53fe","sortOrder":6},"sortOrder":6,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"e868ab60-ad86-4b11-8dfe-370df45dc65f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e868ab60-ad86-4b11-8dfe-370df45dc65f"}],"recentChangeFlags":null},{"id":"c3c5bdf6-3a60-4e9a-ac59-420e5d99c41e","uri":"","name":"https://*.convio.net/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3d45bd76-be36-41b6-80d9-a139f657b697","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c3c5bdf6-3a60-4e9a-ac59-420e5d99c41e"}],"recentChangeFlags":null},{"id":"890a5b0c-e91e-489f-94d8-9c7fa08e4508","uri":"","name":"https://*.convio.com/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"58779547-a6be-487a-bec4-030c08c853d0","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"890a5b0c-e91e-489f-94d8-9c7fa08e4508"}],"recentChangeFlags":null},{"id":"5a9d17bf-4dd6-4f92-92f1-91916be78e12","uri":"https://processingv2.yourcause.com/","name":"https://processingv2.yourcause.com/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"76ea24f1-369d-4ccc-9302-d1be9d79fbe9","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5a9d17bf-4dd6-4f92-92f1-91916be78e12"}],"recentChangeFlags":null},{"id":"a65cbfb3-896f-4461-b1ce-2fb425228fbd","uri":"https://bugcrowdninja.yourcauseuat.com/","name":"https://bugcrowdninja.yourcauseuat.com/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e15fe406-70e5-4461-be36-042c8370ffd8","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a65cbfb3-896f-4461-b1ce-2fb425228fbd"}],"recentChangeFlags":null},{"id":"9b63b7cb-b2fa-4011-9d3b-4c123d781817","uri":"https://blackbaudgivingfund.org/","name":"https://blackbaudgivingfund.org/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"126807b6-5de4-4fe2-8985-f0c55f795a2c","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9b63b7cb-b2fa-4011-9d3b-4c123d781817"}],"recentChangeFlags":null},{"id":"87f06725-705b-4b61-8b96-aab76a0df81b","uri":"https://www.yourcause.com/","name":"https://www.yourcause.com/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5d042873-84cf-49cb-b970-7c93d05cf907","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"87f06725-705b-4b61-8b96-aab76a0df81b"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"7e73d1af-671a-44de-8d96-e51e9c30fe24","name":"Out of Scope","targets":[{"id":"511be325-281a-470a-9460-92140b79c73b","uri":null,"name":"http://community.blackbaud.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7830973b-f525-4594-acaa-228c3954575e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"5439937d-d0f2-4734-b4f9-5f3dfaf2b52d","uri":"","name":"https://app.blackbaud.com/hostnet","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"57b49b3d-1966-4d48-a724-668e81e59642","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"a8797d7d-bdf5-4dad-802e-414f71e5855c","code":"blackbaud-vdp","state":"in_progress","endsAt":null,"bountyId":"df011867-a037-433f-bcd0-337b25b851f6","startsAt":"2020-07-16T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/194a/c2f0/79f9e133/b4b9e25e2b97c9b25697e3f6709a3e7f_blackbaud.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-07-16T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/blackbaud-vdp","changelogs":"/engagements/blackbaud-vdp/changelog","submissions":null,"announcements":"/engagements/blackbaud-vdp/announcements","hallOfFame":"/engagements/blackbaud-vdp/hall_of_fames","crowdstream":null},"announcementsCount":10,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/blackbaud-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=blackbaud-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/blackbaud-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/blackbaud-vdp/changelog","publishedAt":"2025-12-11T17:22:35.859Z","engagementChangelogUrl":"/engagements/blackbaud-vdp/changelog/cbd0ed85-67d6-40c9-8805-dfe11889abb0","createUserFeedbacksUrl":"/engagements/blackbaud-vdp/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}