{"id":"33280231-4d3c-4ce3-9c8f-8d8ee98aeec7","engagementId":"bb125dda-1ae1-4429-8cdc-d0bf61efc158","data":{"brief":{"id":"2a3b32bc-22b3-46a6-835d-eb4b21687158","name":"OneTrust","tagline":"OneTrust helps companies build and demonstrate trust, measure and manage risk, and go beyond compliance. ","description":"\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003ePlease note that rewards within a Priority Range are determined by CVSS score. \u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of OneTrust not listed in the targets section is out of scope. This includes any/all subdomains not listed above._ If you believe you've identified a vulnerability on a system outside the scope, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before submitting and note that these will not be eligible for compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eProgram Rules:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eVulnerability reports on the same vulnerability across different endpoints or targets belonging to this program are not eligible for multiple rewards. Please submit a single report. Failure to do so may result in denial of bounty.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eThe targets will be accessed through a OneTrust staging environment. Submissions made using any environment other than pentest-app.onetrust.com is \u003cem\u003eineligible for a bounty\u003c/em\u003e.\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eCredentials can be retrieved from the retrieve credential section of the brief. With that email address, you can perform a \u003ccode\u003eForgot Password\u003c/code\u003e password reset to gain access to the account. \u003cstrong\u003eThe forgot password email will take a few minutes to arrive in your inbox.\u003c/strong\u003e The provided account is an admin level credential and from there you will be able to create multiple credentials of varying credential levels for testing.   \u003cstrong\u003ePlease do not modify any credentials that were not assigned or created by yourself.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eExfiltration of customer/user data\u003c/li\u003e\n\u003cli\u003eCritical Modules\n\n\u003cul\u003e\n\u003cli\u003eConsumer Rights Portal (Data Subject Requests)\n\n\u003cul\u003e\n\u003cli\u003eWebforms and workflows are the key areas of this module\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eIntegrations Module\n\n\u003cul\u003e\n\u003cli\u003eEntering customer environments and pulling customer data or metadata from the environments\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eAdditional Notes:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eOneTrust does not pay for hypothetical vulnerabilities. All POCs submitted must be executable by OneTrust and re-creatable outside the confines of the bug bounty environment. When Bugcrowd responds to you with \"As an attacker I could\", OneTrust expects you to use this as a direction and to provide a POC demonstrating that \"could\". If your submission includes the phrase \"an attacker could use this to gain access to your mind!\", we expect you to have already done it too. Any such suggested phrasing is ignored during our review if it is not included in the POC.\u003c/li\u003e\n\u003cli\u003ePlease do not modify the Email Settings in the settings page as it will disrupt any new user creations.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eOut-of-Scope items include, but are not limited to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eSPF/DKIM/DMARC-Related Issues\u003c/li\u003e\n\u003cli\u003eFindings related to Insecure Storage\u003c/li\u003e\n\u003cli\u003eEXIF data present in images\u003c/li\u003e\n\u003cli\u003eAuthorization issues without escalating privileges to full Site Admin\u003c/li\u003e\n\u003cli\u003eMissing Security Best Practices, i.e. Security Headers, Mixed content, SSL/TLS, etc.\u003c/li\u003e\n\u003cli\u003eXSS is out of scope if html sanitization is disabled.\u003c/li\u003e\n\u003cli\u003eSocial Engineering\u003c/li\u003e\n\u003cli\u003eRate-limiting issues\u003c/li\u003e\n\u003cli\u003eConcurrent login caching API calls\u003c/li\u003e\n\u003cli\u003eSession validation after password reset or change\u003c/li\u003e\n\u003cli\u003ePassword Policy\u003c/li\u003e\n\u003cli\u003etinyMCE vulnerabilities\u003c/li\u003e\n\u003cli\u003eCSRF vulnerabilities\u003c/li\u003e\n\u003cli\u003eHost header injection without proof of user data extraction\u003c/li\u003e\n\u003cli\u003eDoS/DDoS\u003c/li\u003e\n\u003cli\u003eAutocomplete attribute on web forms\u003c/li\u003e\n\u003cli\u003eSoftware Version Disclosure and verbose error pages (without proof of exploitability)\u003c/li\u003e\n\u003cli\u003eOpen ports without an accompanying proof-of-concept demonstrating vulnerability\u003c/li\u003e\n\u003cli\u003eDisclosure of known public files or directories\u003c/li\u003e\n\u003cli\u003eUse of outdated software/library versions\u003c/li\u003e\n\u003cli\u003eClickjacking on pages with no sensitive actions\u003c/li\u003e\n\u003cli\u003eRecently disclosed (\u0026lt;30 days) zero-day vulnerabilities where a patch is unavailable\u003c/li\u003e\n\u003cli\u003eSubmissions from current OneTrust employees or those who have worked at OneTrust within the last 12 months\u003c/li\u003e\n\u003cli\u003eSubmissions from customers or companies performing penetration tests on behalf of customers\u003c/li\u003e\n\u003cli\u003eSubmissions made from any environment other than pentest-app.onetrust.com are ineligible for bounties and will be deemed out of scope\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003ePlease note that we reserve the right not to reward findings related to database or password leaks, in order to avoid encouraging grey-area activities\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"36424536-acf0-468f-8f46-fb51329c170e","name":"In-Scope Targets","targets":[{"id":"7dace86e-5005-4f65-bf83-35e287ba236e","uri":"https://pentest-app.onetrust.com/","name":"https://pentest-app.onetrust.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3cc6e836-06b8-4ba1-a89f-57e6225ce2c3","sortOrder":0},"sortOrder":0,"tags":[{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"7dace86e-5005-4f65-bf83-35e287ba236e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7dace86e-5005-4f65-bf83-35e287ba236e"},{"id":"e4ad1c44-2f86-487b-9793-0add0dbfdcf2","name":"Zone.js","targetId":"7dace86e-5005-4f65-bf83-35e287ba236e"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"7dace86e-5005-4f65-bf83-35e287ba236e"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"b03a8bf0-a246-41a4-89b4-d1f96c4c58d8","p1MaxCents":650000,"p1MinCents":300100,"p2MaxCents":300000,"p2MinCents":80100,"p3MaxCents":80000,"p3MinCents":50100,"p4MaxCents":50000,"p4MinCents":30000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":3001,"max":6500},"2":{"min":801,"max":3000},"3":{"min":501,"max":800},"4":{"min":300,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"3a2d683b-e829-421c-9fae-14daeb4dd8fb","name":"Out-of-Scope Targets","targets":[{"id":"51b6c5bc-eebf-4c31-835f-eae89304ed58","uri":"","name":"https://*.onetrust.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"15088c50-9305-4cda-87b1-246f984690fb","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"ba4b1208-5847-482d-9207-292783aee507","uri":"","name":"https://store.onetrust.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"23b61ff3-34a1-4c84-a2af-d83f71d4b62c","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c7541431-f130-42d9-9085-c4deacf838f7","uri":"","name":"https://*.convercent.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ea8c1e19-fe92-4b92-85c1-acd49496eaa9","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a7589c26-35ad-4f20-b70c-29f988f0651f","uri":"","name":"https://*.dataguidance.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d8be1839-b786-4c5d-b421-f38432b44bc1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"b81b610b-5218-46ea-934a-0c3597a57b09","uri":"","name":"https://app.vendorpedia.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aa66b9c2-42c1-4191-a616-6f1f4c490cf7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"043d8345-8f67-4b54-a5f5-2e9e0d8a71dd","uri":"","name":"https://*.preferencechoice.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9bbcda15-1942-4a71-aece-a1837ded82be","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e825d138-fb5c-4056-96de-d0f6e0dcd37e","uri":"","name":"https://*.redacted.ai","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9993e3fd-7ebf-418f-af03-69a786a1acd5","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c5d10b8f-dd8a-4626-a73d-0fe79a6e60b1","uri":"","name":"https://*.sharedassessments.org","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b792ebda-1280-4354-a1c4-a690dba3c6ab","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"54b6583e-3e97-450b-b54e-9db9dcee7517","uri":"","name":"https://developer.onetrust.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"25727003-25ab-4ab5-980f-d8915c36449a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"097e2cb4-5a5f-41d7-aced-34cacfd0c21f","uri":"","name":"https://my.onetrust.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"db48a8e1-612d-4db6-8930-8d7b01a34dcc","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7ea19629-80e5-47f0-ad50-8688e3346f94","uri":"","name":"https://*.vendorpedia.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2f8a1248-eb73-480d-9eff-e5bd7dffd2f1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"47abce5c-6069-41c6-a837-b13d0004ba8a","uri":"","name":"https://*.onetrustgrc.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2113826d-ebdb-4708-a5fb-e33e9a7689a9","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c3680c68-113a-4133-829c-1212f8a1282d","uri":"","name":"https://*.cookiepro.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e40ea84f-e977-45b4-9cf7-0066bb9db71c","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"ee1ba1c0-c8f4-44b8-a865-687d07e6f5e7","uri":"","name":"https://tv.onetrust.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"11e240be-5ef4-432e-8f5d-e410ffd66489","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"deb50d24-4ef5-4e96-bcfa-bc1e8e4c8c45","uri":"","name":"https://*.cookielaw.org","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e83184db-d02c-420e-b2ec-a5ead5ddd0a7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"4dc10a35-1341-4a6d-bf01-f65838bd78c3","uri":"","name":"https://*.onetrustpro.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b6c7c8b2-7ee6-458d-87a1-30666afd397f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a6e0c5e8-8ce7-4f05-9b99-24819ac45915","uri":"","name":"https://*.privacyconnect.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"22585164-f497-4634-b5da-7b8e51fc198c","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"5355a87a-1fc5-462c-a97a-e416ef397b4d","uri":"","name":"https://*.onetrust.de","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2a564103-8fd1-48f8-9b73-042dd889c2e7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"6f0d6106-2805-43b8-a5e6-ccfd043050a4","uri":"","name":"https://*.onetrust.se","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9508eef2-56b9-42ab-b565-0e2701e7531a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"164c840b-1444-44d4-a392-9437398d7766","uri":"","name":"https://*.onetrust.es","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"934581ba-1942-4f07-b29f-8278b485d07d","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"bbd33bf7-9cde-4b4e-8369-4ce776cb837d","uri":"","name":"https://*.onetrust.fr","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7688e274-c11d-4849-8440-d2c521410304","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"57ef417a-a755-4c10-b36a-24ac213d11e4","uri":"","name":"https://*.onetrust.it","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bd39b69d-8f20-48cd-b670-96c70444a0c7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c031b7ed-70bc-4643-8389-7be2023ac848","uri":"","name":"https://*.privacytech.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b606ea57-81bd-434f-aaff-3f02a7ea61ac","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"02950203-cd76-4544-b602-70948d28c433","uri":"","name":"https://*.privacypedia.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"64fff249-56eb-4d86-a8c0-77a808cbd9f5","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"4e7c8964-3a5f-4572-9e9e-6e137411ef33","uri":"","name":"https://*.esgiq.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e34e5526-c740-402e-a9f4-b7026315d082","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"5e32d183-c895-45ec-86d3-44031ab7cca9","uri":"","name":"https://*.trustweek2021.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7b495380-a9f8-466f-aeab-5114c875af75","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"7db3aa55-2f76-472e-ba67-990a5db2ebe8","attachmentPath":"https://bugcrowd.com/engagements/onetrust/attachments/7db3aa55-2f76-472e-ba67-990a5db2ebe8","name":"image-2025-10-29T10:04:42.523Z.png","filename":"image-2025-10-29T10:04:42.523Z.png","description":null,"icon":"fileImage","size":15721,"sizeLabel":"15.4 KB","uploadedAt":"29 Oct 2025","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/onetrust/attachments/7db3aa55-2f76-472e-ba67-990a5db2ebe8"}],"engagement":{"id":"bb125dda-1ae1-4429-8cdc-d0bf61efc158","code":"onetrust","state":"in_progress","endsAt":null,"bountyId":"57a592d3-68db-454f-8731-44fedeb71379","startsAt":"2020-03-24T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/5d13/5aa3/80d9fe36/069f6818c6fcb42d48bae2bf0b58190c_ot-logo-square-512__1_.png","logoBackgroundColor":"#000000","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-03-24T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/onetrust","changelogs":"/engagements/onetrust/changelog","submissions":null,"announcements":"/engagements/onetrust/announcements","hallOfFame":"/engagements/onetrust/hall_of_fames","crowdstream":"/engagements/onetrust/crowdstream"},"announcementsCount":34,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"P1 24/7","submitReportUrl":"/engagements/onetrust/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=onetrust\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/onetrust/engagement_subscribers","engagementChangelogsUrl":"/engagements/onetrust/changelog","publishedAt":"2025-12-22T19:03:41.353Z","engagementChangelogUrl":"/engagements/onetrust/changelog/33280231-4d3c-4ce3-9c8f-8d8ee98aeec7","createUserFeedbacksUrl":"/engagements/onetrust/feedbacks","engagementCrowdstreamUrl":"/engagements/onetrust/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}