{"id":"8b189f30-aa6b-47a4-b050-f6e9c588de1c","engagementId":"f087e3f1-34e8-43b6-8b35-91f069f7fad8","data":{"brief":{"id":"97579af2-4d9c-454a-a75e-d2116151077c","name":"JLL Vulnerability Disclosure Engagement","tagline":"JLL is a leading real estate and investment management firm using advanced technology to create sustainable solutions for clients, communities, and the future of real estate.","description":"\u003cp\u003eWe’re a leading professional services firm that specializes in real estate and investment management. JLL shapes the future of real estate for a better world by using the most advanced technology to create rewarding opportunities, amazing spaces and sustainable real estate solutions for our clients, our people and our communities.  \u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect, and JLL believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"f7d6118f-e788-4bb7-a2a6-7078424c9d3c","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Jones, Lang, Lasalle not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before submitting.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExclusions\u003c/h2\u003e\n\n\u003cp\u003eTesting exclusions: \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eNo denial-of-service based testing (distributed or otherwise) is acceptable\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease do not submit any contact or order forms as a part of exploration / testing\u003c/li\u003e\n\u003cli\u003eDo not use automated tools against chatbot implementation \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eN-Day Policy\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhen N-Day bugs are released to the public, we will consider these as in scope \u003cem\u003eafter\u003c/em\u003e 14 days have gone by\n\n\u003cul\u003e\n\u003cli\u003ee.g: N-day released on January 1st, we would consider it in-scope on January 15th\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"6ced1938-6230-4b7f-9357-5b660c9e1313","name":"In Scope","targets":[{"id":"4b15a156-6f04-4471-9bff-2f847b1a705b","uri":"https://www.us.jll.com/en/locations","name":"https://www.us.jll.com/en/locations","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1132053d-c7cc-47e6-818f-0f464084fc20","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"4b15a156-6f04-4471-9bff-2f847b1a705b"},{"id":"73ea470f-6fb9-4636-900b-259e5466f37e","name":"Apache httpd","targetId":"4b15a156-6f04-4471-9bff-2f847b1a705b"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4b15a156-6f04-4471-9bff-2f847b1a705b"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"4b15a156-6f04-4471-9bff-2f847b1a705b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4b15a156-6f04-4471-9bff-2f847b1a705b"}],"recentChangeFlags":null},{"id":"4e454b7f-a2e5-4f3a-a264-37c7cf6f81cb","uri":"","name":"*.jll.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e718607b-15b0-4564-8c49-a3d2c482658a","sortOrder":1},"sortOrder":1,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"4e454b7f-a2e5-4f3a-a264-37c7cf6f81cb"},{"id":"73ea470f-6fb9-4636-900b-259e5466f37e","name":"Apache httpd","targetId":"4e454b7f-a2e5-4f3a-a264-37c7cf6f81cb"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4e454b7f-a2e5-4f3a-a264-37c7cf6f81cb"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"4e454b7f-a2e5-4f3a-a264-37c7cf6f81cb"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4e454b7f-a2e5-4f3a-a264-37c7cf6f81cb"}],"recentChangeFlags":null},{"id":"13975cfc-726c-42aa-a65a-8703d1995823","uri":"","name":"*.jllt.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3f512c14-983c-4225-acae-4591b3463362","sortOrder":2},"sortOrder":2,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"13975cfc-726c-42aa-a65a-8703d1995823"},{"id":"73ea470f-6fb9-4636-900b-259e5466f37e","name":"Apache httpd","targetId":"13975cfc-726c-42aa-a65a-8703d1995823"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"13975cfc-726c-42aa-a65a-8703d1995823"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"13975cfc-726c-42aa-a65a-8703d1995823"}],"recentChangeFlags":null},{"id":"a9a2486d-bb08-43ac-9dcd-a48652c0377e","uri":"","name":"*.corrigo-qa.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"72be1191-e2ef-4dc2-885c-0dcef4bde992","sortOrder":3},"sortOrder":3,"tags":[{"id":"076d29a6-dedd-43ec-ae8a-6c8ea571915b","name":"SQL","targetId":"a9a2486d-bb08-43ac-9dcd-a48652c0377e"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"a9a2486d-bb08-43ac-9dcd-a48652c0377e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a9a2486d-bb08-43ac-9dcd-a48652c0377e"}],"recentChangeFlags":null},{"id":"99191892-08ee-43d7-8bb4-94f731d05e5c","uri":"","name":"*.corrigopro-qa.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1fe07ecf-05cb-4598-a11f-47373532f805","sortOrder":4},"sortOrder":4,"tags":[{"id":"076d29a6-dedd-43ec-ae8a-6c8ea571915b","name":"SQL","targetId":"99191892-08ee-43d7-8bb4-94f731d05e5c"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"99191892-08ee-43d7-8bb4-94f731d05e5c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"99191892-08ee-43d7-8bb4-94f731d05e5c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eAll of the below targets are publicly accessible. Accounts can be provisioned where signup is available. Some of the targets will not have any type of account associated with them and are used for marketing. \u003c/p\u003e\n\n\u003ch4\u003eTarget Info\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003ehttps://www.jll.com\u003cbr\u003e\nDescription: Main enterprise website. Contact information collection, chatbot available, and other general corporate solutions and services information accessible via this site.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ehttps://www.jllt.com\u003cbr\u003e\nDescription: JLL Technologies division production sub-site.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ehttps://www.corrigo-qa.com \u0026amp;  https://www.corrigopro-qa.com\u003cbr\u003e\nDescription: QA sites for one of JLL’s enterprise facilities management platforms.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"f087e3f1-34e8-43b6-8b35-91f069f7fad8","code":"jll-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"a2e30c2b-2f45-4522-9ca9-7e40e985f608","startsAt":"2025-01-07T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Real Estate","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/0e6d/a252/7434a6a1/b7478309867244a21246b06066b5fae1_jll_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":false,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-01-07T18:00:00.582Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/jll-vdp-pro","changelogs":"/engagements/jll-vdp-pro/changelog","submissions":null,"announcements":"/engagements/jll-vdp-pro/announcements","hallOfFame":"/engagements/jll-vdp-pro/hall_of_fames","crowdstream":"/engagements/jll-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/jll-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=jll-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/jll-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/jll-vdp-pro/changelog","publishedAt":"2026-06-02T15:07:43.588Z","engagementChangelogUrl":"/engagements/jll-vdp-pro/changelog/8b189f30-aa6b-47a4-b050-f6e9c588de1c","createUserFeedbacksUrl":"/engagements/jll-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/jll-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}