{"id":"0c899c30-200f-4bad-88fb-bfd8ba404618","engagementId":"cbd79ffb-2db4-469f-93aa-6bfceb8a711a","data":{"brief":{"id":"046b4cb9-ba83-46fb-9823-94ce687a8cfd","name":"CIBC VDP","tagline":"Canadian multinational banking and financial services","description":"\u003cp\u003eWelcome to CIBC’s Responsible Disclosure Program\u003c/p\u003e\n\n\u003cp\u003eAt CIBC, we’re committed to keeping you and your banking information safe so you can bank with confidence, no matter where you are. As part of our ongoing security activities, we provide a Responsible Disclosure Program (also called “Program”), which allows you to share with us any potential security vulnerability on a CIBC-related site or system. \u003c/p\u003e","industryTagId":"b3d6ff0b-119e-4f5b-9c38-ee13f125fc52","targetsOverview":"\u003ch2\u003eReporting:\u003c/h2\u003e\n\n\u003cp\u003e• To make a disclosure, you will first need to sign up with Bugcrowd \u003ca href=\"https://bugcrowd.com/user/sign_up\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e or login to your existing account.\u003cbr\u003e\n•.      Please note that this Program should not be construed as encouragement or permission to perform any of the following activities:\u003cbr\u003e\n    •     Hack, penetrate or otherwise attempt to gain unauthorized access to CIBC software or systems in violation of applicable law\u003cbr\u003e\n    •     Disclose or use any proprietary or confidential CIBC information or data, including any customer data; and\u003cbr\u003e\n    •     Adversely impact CIBC or the operation of CIBC software or systems\u003cbr\u003e\nCIBC does not waive any rights or claims with respect to such activities.\u003cbr\u003e\n• The use of personal credentials for testing purposes is permitted but is expected to follow the terms and conditions of those systems. This would include the Electronic Access Agreement (at https://www.cibc.com/en/legal/agreements/electronic-access.html) and Website Terms of Use (at https://www.cibc.com/en/legal/agreements/terms-of-use-cibc.html). Failure to comply with these terms may trigger or result in investigations by the CIBC fraud team and/or law enforcement. This is to protect you and your banking accounts, as well as CIBC. This Program is set up as an unauthenticated program. If you discover other credentials during recon and testing, please do NOT use them for additional testing.\u003cbr\u003e\n• Researchers should NOT pursue post-exploitation unless explicitly approved by CIBC to do so.\u003cbr\u003e\n• Please be aware that CIBC may or may not correspond with you directly to disclose remediation steps or timeframes. Communications will primarily be facilitated by BugCrowd as required, although CIBC staff may contact you directly in certain circumstances.\u003cbr\u003e\u003cbr\u003e\n• You may not publicize or disclose your submission or its results to any third party without CIBC's express permission to do so.\u003cbr\u003e\n• Cross-environment findings will be considered duplicates. If you would like to group together one finding found across multiple environments, feel free to submit them under one disclosure!\u003cbr\u003e\n• No monetary compensation or disbursements for findings will be provided on this Program.\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003eThis Program uses the Bugcrowd Vulnerability Rating Taxonomy. In some cases a vulnerability priority will be modified due to its likelihood or impact. \u003c/p\u003e","safeHarborStatus":null,"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"3951718c-a746-46ba-97df-a65d159bc9c4","name":"In Scope Targets","targets":[{"id":"17d555c7-c6a2-4457-97dd-b8d422f53358","uri":"","name":"CIBC FirstCaribbean International Bank (FCIB)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"43a958e7-94ec-4170-b2a9-c465cbae492b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"17d555c7-c6a2-4457-97dd-b8d422f53358"}],"recentChangeFlags":null},{"id":"3c044e5f-453b-4e3f-a949-652d8ee58ac0","uri":"","name":"CIBC Bank USA","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"de1119cf-0e9e-4489-9050-22e699229fab","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3c044e5f-453b-4e3f-a949-652d8ee58ac0"}],"recentChangeFlags":null},{"id":"f18ec2a6-03c3-4f3e-bd76-1796dc5b9250","uri":"","name":"CIBC Mellon","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6092a694-c01c-4025-86e7-9d4117edb6f4","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f18ec2a6-03c3-4f3e-bd76-1796dc5b9250"}],"recentChangeFlags":null},{"id":"1ef37aa8-a9d7-48bc-88c6-319db92414f3","uri":"","name":"Simplii Financial ","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"39a23a66-57fc-4887-9b78-f699bcf993a2","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1ef37aa8-a9d7-48bc-88c6-319db92414f3"}],"recentChangeFlags":null},{"id":"9c9a793b-7fa5-4ed0-b675-22b811a39ca0","uri":"","name":"CIBC","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f1aa07b8-5576-4df8-89b9-89ed5a889838","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9c9a793b-7fa5-4ed0-b675-22b811a39ca0"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eAny CIBC owned asset is in scope. This includes CIBC as well as the affiliations listed below.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"908cca6b-b84c-467b-9f73-6a6367499e39","name":"Out of Scope ","targets":[{"id":"a9eb3ff7-a09b-4866-905c-0c086d395b89","uri":"","name":"Anything not explicitly listed as In Scope ","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"13045435-f6ff-4555-8bb7-3155e8000c70","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"cbd79ffb-2db4-469f-93aa-6bfceb8a711a","code":"cibc-vdp","state":"in_progress","endsAt":null,"bountyId":"9500b2da-a5f7-4ee1-af54-d7c9644f80f6","startsAt":"2022-10-25T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Banking","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/5823/3e17/07e89e10/f98e9ca6b0f3899abeb514baf9c82cee_cibc_logo_4.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-10-25T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/cibc-vdp","changelogs":"/engagements/cibc-vdp/changelog","submissions":null,"announcements":"/engagements/cibc-vdp/announcements","hallOfFame":"/engagements/cibc-vdp/hall_of_fames","crowdstream":null},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/cibc-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=cibc-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/cibc-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/cibc-vdp/changelog","publishedAt":"2023-03-14T18:43:02.620Z","engagementChangelogUrl":"/engagements/cibc-vdp/changelog/0c899c30-200f-4bad-88fb-bfd8ba404618","createUserFeedbacksUrl":"/engagements/cibc-vdp/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}