{"id":"b503b4ee-59b2-4fc5-8273-b7edb619462d","engagementId":"9b6839d4-9f02-4e98-a18f-4d361dda4cd9","data":{"brief":{"id":"f18396c3-b2f8-4e10-a172-7ebe13b27bed","name":"New Blue Website (NBW) - VWFS Bug Bounty Program","tagline":"VW Financial Services is the largest provider of automotive financial services worldwide.  VW Financial Services owe their success to our employees, who deploy their knowledge, talents and energy for the good of our company day in and day out.","description":"\u003cp\u003e\u003cstrong\u003eNew Blue Website (NBW) (vwfs.de)\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eAt VWFS.de, we are an online platform that offers a wide range of financial products and services specifically designed for Volkswagen Group customers. With VWFS.de, we understand that purchasing a vehicle is a significant decision, which is why we offer flexible financing options tailored to our customers specific requirements. Whether they`re looking for a loan, leasing, or other financing solutions, our goal is to make owning a Volkswagen vehicle simpler and more attainable.\u003c/p\u003e\n\n\u003cp\u003eIn addition to financing, we also offer insurance products. Our comprehensive coverage options provide peace of mind, so customers can enjoy their vehicle without worrying about unexpected events.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Volkswagen Financial Services AG not listed in the targets section is out of scope. This includes any/all subdomains not listed above. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cp\u003eTesting is unauthenticated only.\u003c/p\u003e\n\n\u003ch3\u003eAccess-Header:\u003c/h3\u003e\n\n\u003cp\u003eIn order for our team not to lock you out from our applications due to suspicious behavior, we request that you send a custom header with every request:\u003cbr\u003e\n\u003ccode\u003e{ x-bugcrowd-tester: (your-Bugcrowd-username) }\u003c/code\u003e\u003c/p\u003e\n\n\u003ch3\u003eGeneral Out-of-Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny form and type of social engineering\u003c/li\u003e\n\u003cli\u003eContacting our agents/customer support\u003c/li\u003e\n\u003cli\u003eThird Party Applications and Scripts\u003c/li\u003e\n\u003cli\u003eLoad testing and rate limiting issues\u003c/li\u003e\n\u003cli\u003eD/DOS (However \"Application self-DOS\" is \u003cstrong\u003ein scope\u003c/strong\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eThird party services\u003c/h4\u003e\n\n\u003cp\u003eVWFS uses a number of third-party providers and services – including a number hosted on subdomains of VWFS domains that will be considered OOS for this program. We cannot authorize security testing against systems that do not belong to us, but strongly suggest reporting issues identified within these services to the third party directly. However, if you believe an issue with one of our third-party service providers is the result of VWFS's  misconfiguration or insecure usage of that service. Or you've reported an issue affecting many customers of the service that you believe VWFS can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we'd appreciate your report regarding the issue.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"9203ea97-8a9c-4618-a6e8-519d03058cda","name":"In Scope Targets","targets":[{"id":"2ca3fdb6-883f-4383-81f8-cdfb1d0a4b69","uri":"https://www.vwfs.de","name":"https://www.vwfs.de","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c30b4a0d-fe3d-4577-939e-6eb33c136247","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"2ca3fdb6-883f-4383-81f8-cdfb1d0a4b69"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"2ca3fdb6-883f-4383-81f8-cdfb1d0a4b69"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"2ca3fdb6-883f-4383-81f8-cdfb1d0a4b69"},{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"2ca3fdb6-883f-4383-81f8-cdfb1d0a4b69"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"2ca3fdb6-883f-4383-81f8-cdfb1d0a4b69"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"2ca3fdb6-883f-4383-81f8-cdfb1d0a4b69"}],"recentChangeFlags":null},{"id":"a8ad5558-795e-4704-92ae-c389002e78f2","uri":"https://www.vwfs.de/","name":"https://www.vwfs.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"24b52587-9401-44de-a44a-fd647b6c5f6c","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"a8ad5558-795e-4704-92ae-c389002e78f2"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"a8ad5558-795e-4704-92ae-c389002e78f2"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"a8ad5558-795e-4704-92ae-c389002e78f2"},{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"a8ad5558-795e-4704-92ae-c389002e78f2"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"a8ad5558-795e-4704-92ae-c389002e78f2"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"a8ad5558-795e-4704-92ae-c389002e78f2"}],"recentChangeFlags":null},{"id":"0b265e03-5411-4bb3-884b-6eb005e3de93","uri":"https://www.vwfs.pl","name":"https://www.vwfs.pl","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ce41a434-df75-4f62-a951-81f811046142","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"0b265e03-5411-4bb3-884b-6eb005e3de93"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"0b265e03-5411-4bb3-884b-6eb005e3de93"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"0b265e03-5411-4bb3-884b-6eb005e3de93"},{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"0b265e03-5411-4bb3-884b-6eb005e3de93"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"0b265e03-5411-4bb3-884b-6eb005e3de93"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"0b265e03-5411-4bb3-884b-6eb005e3de93"}],"recentChangeFlags":null},{"id":"05e7f11e-ed57-4766-96f5-30316c5907f5","uri":"https://www.vwfs.com.ar","name":"https://www.vwfs.com.ar","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bfb7ca6c-033a-4ef8-86fc-aa2af5e8a376","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"05e7f11e-ed57-4766-96f5-30316c5907f5"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"05e7f11e-ed57-4766-96f5-30316c5907f5"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"05e7f11e-ed57-4766-96f5-30316c5907f5"},{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"05e7f11e-ed57-4766-96f5-30316c5907f5"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"05e7f11e-ed57-4766-96f5-30316c5907f5"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"05e7f11e-ed57-4766-96f5-30316c5907f5"}],"recentChangeFlags":null},{"id":"fdaed6b5-4471-4e63-8dca-de11789ecc1f","uri":"https://www.vwfs.com.au","name":"https://www.vwfs.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fedff6f5-c20e-43b7-9b10-bc41fbae753c","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"fdaed6b5-4471-4e63-8dca-de11789ecc1f"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"fdaed6b5-4471-4e63-8dca-de11789ecc1f"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"fdaed6b5-4471-4e63-8dca-de11789ecc1f"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"fdaed6b5-4471-4e63-8dca-de11789ecc1f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fdaed6b5-4471-4e63-8dca-de11789ecc1f"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"fdaed6b5-4471-4e63-8dca-de11789ecc1f"}],"recentChangeFlags":null},{"id":"3e007233-6e56-46e5-a190-e373854dae8f","uri":"https://www.vwfs.cz","name":"https://www.vwfs.cz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e1417bc1-3661-4b2c-aeef-c15302dc3fe1","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"3e007233-6e56-46e5-a190-e373854dae8f"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"3e007233-6e56-46e5-a190-e373854dae8f"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"3e007233-6e56-46e5-a190-e373854dae8f"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"3e007233-6e56-46e5-a190-e373854dae8f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3e007233-6e56-46e5-a190-e373854dae8f"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"3e007233-6e56-46e5-a190-e373854dae8f"}],"recentChangeFlags":null},{"id":"a5c12bc6-837b-408d-bb9c-dde25a9e3a0a","uri":"https://www.vwfs.co.in","name":"https://www.vwfs.co.in","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"25efc701-b0d8-41c8-8955-85d67146be87","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"a5c12bc6-837b-408d-bb9c-dde25a9e3a0a"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"a5c12bc6-837b-408d-bb9c-dde25a9e3a0a"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"a5c12bc6-837b-408d-bb9c-dde25a9e3a0a"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"a5c12bc6-837b-408d-bb9c-dde25a9e3a0a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a5c12bc6-837b-408d-bb9c-dde25a9e3a0a"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"a5c12bc6-837b-408d-bb9c-dde25a9e3a0a"}],"recentChangeFlags":null},{"id":"54805361-ad4b-499d-bc1d-4a8fbd47344c","uri":"https://www.vwfs.ie","name":"https://www.vwfs.ie","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"de059f12-ca2a-48fd-b893-586f54167506","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"54805361-ad4b-499d-bc1d-4a8fbd47344c"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"54805361-ad4b-499d-bc1d-4a8fbd47344c"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"54805361-ad4b-499d-bc1d-4a8fbd47344c"},{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"54805361-ad4b-499d-bc1d-4a8fbd47344c"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"54805361-ad4b-499d-bc1d-4a8fbd47344c"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"54805361-ad4b-499d-bc1d-4a8fbd47344c"}],"recentChangeFlags":null},{"id":"2ea4e88d-12af-4ff5-8498-622fb57167d5","uri":"https://www.vwfs.es","name":"https://www.vwfs.es","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"35261bc3-e2d6-4464-abb6-77843c63cbda","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"2ea4e88d-12af-4ff5-8498-622fb57167d5"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"2ea4e88d-12af-4ff5-8498-622fb57167d5"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"2ea4e88d-12af-4ff5-8498-622fb57167d5"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"2ea4e88d-12af-4ff5-8498-622fb57167d5"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2ea4e88d-12af-4ff5-8498-622fb57167d5"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"2ea4e88d-12af-4ff5-8498-622fb57167d5"}],"recentChangeFlags":null},{"id":"c82f58ff-12c0-4757-a441-728b552bd1ce","uri":"https://www.vwfs.co.za","name":"https://www.vwfs.co.za","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2af5d664-8eea-48d3-9950-883a04445fa6","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"c82f58ff-12c0-4757-a441-728b552bd1ce"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"c82f58ff-12c0-4757-a441-728b552bd1ce"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"c82f58ff-12c0-4757-a441-728b552bd1ce"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"c82f58ff-12c0-4757-a441-728b552bd1ce"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c82f58ff-12c0-4757-a441-728b552bd1ce"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"c82f58ff-12c0-4757-a441-728b552bd1ce"}],"recentChangeFlags":null},{"id":"95e4887c-a63b-4c81-a260-c31a915f865c","uri":"https://www.vwfs.mx","name":"https://www.vwfs.mx","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bc57be44-9590-4014-b403-17abbfeca905","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"95e4887c-a63b-4c81-a260-c31a915f865c"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"95e4887c-a63b-4c81-a260-c31a915f865c"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"95e4887c-a63b-4c81-a260-c31a915f865c"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"95e4887c-a63b-4c81-a260-c31a915f865c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"95e4887c-a63b-4c81-a260-c31a915f865c"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"95e4887c-a63b-4c81-a260-c31a915f865c"}],"recentChangeFlags":null},{"id":"07ab34d5-89ec-4ef4-b3a3-80113f0afe34","uri":"https://www.vwfs.it","name":"https://www.vwfs.it","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3dcefc00-22a2-4bc4-82c6-f6c4b3644efb","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"07ab34d5-89ec-4ef4-b3a3-80113f0afe34"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"07ab34d5-89ec-4ef4-b3a3-80113f0afe34"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"07ab34d5-89ec-4ef4-b3a3-80113f0afe34"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"07ab34d5-89ec-4ef4-b3a3-80113f0afe34"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"07ab34d5-89ec-4ef4-b3a3-80113f0afe34"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"07ab34d5-89ec-4ef4-b3a3-80113f0afe34"}],"recentChangeFlags":null},{"id":"ce89be74-2afa-4403-9f99-c442075735a6","uri":"https://www.vwfs.fr","name":"https://www.vwfs.fr","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b2f312f4-6057-4487-af6b-efeb2488cc44","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"ce89be74-2afa-4403-9f99-c442075735a6"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"ce89be74-2afa-4403-9f99-c442075735a6"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"ce89be74-2afa-4403-9f99-c442075735a6"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"ce89be74-2afa-4403-9f99-c442075735a6"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ce89be74-2afa-4403-9f99-c442075735a6"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"ce89be74-2afa-4403-9f99-c442075735a6"}],"recentChangeFlags":null},{"id":"2de4699f-3487-4349-8e89-5636014abb18","uri":"https://www.vwfs.com.br","name":"https://www.vwfs.com.br","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8c71e017-5449-401a-8bc0-1a0f61ea1256","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"2de4699f-3487-4349-8e89-5636014abb18"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"2de4699f-3487-4349-8e89-5636014abb18"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"2de4699f-3487-4349-8e89-5636014abb18"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"2de4699f-3487-4349-8e89-5636014abb18"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2de4699f-3487-4349-8e89-5636014abb18"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"2de4699f-3487-4349-8e89-5636014abb18"}],"recentChangeFlags":null},{"id":"fb7ef7a4-6774-403f-8b67-8a226dc6ac9a","uri":"https://www.vwfs.pt","name":"https://www.vwfs.pt","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"930b1d68-65b0-4dd2-b872-a94529b68b44","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"fb7ef7a4-6774-403f-8b67-8a226dc6ac9a"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"fb7ef7a4-6774-403f-8b67-8a226dc6ac9a"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"fb7ef7a4-6774-403f-8b67-8a226dc6ac9a"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"fb7ef7a4-6774-403f-8b67-8a226dc6ac9a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fb7ef7a4-6774-403f-8b67-8a226dc6ac9a"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"fb7ef7a4-6774-403f-8b67-8a226dc6ac9a"}],"recentChangeFlags":null},{"id":"de25c918-5234-4ea1-ad15-6e06585c8612","uri":"https://www.vwfs.sk","name":"https://www.vwfs.sk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3414c621-b998-49e1-8ba8-fc3e608f50f4","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"de25c918-5234-4ea1-ad15-6e06585c8612"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"de25c918-5234-4ea1-ad15-6e06585c8612"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"de25c918-5234-4ea1-ad15-6e06585c8612"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"de25c918-5234-4ea1-ad15-6e06585c8612"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"de25c918-5234-4ea1-ad15-6e06585c8612"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"de25c918-5234-4ea1-ad15-6e06585c8612"}],"recentChangeFlags":null},{"id":"7d19b10a-f645-46d7-8e3f-8bda872a09ed","uri":"https://www.vwfs.gr","name":"https://www.vwfs.gr","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2c3cc7b0-7330-4dde-b5e0-1804e9467307","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"7d19b10a-f645-46d7-8e3f-8bda872a09ed"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"7d19b10a-f645-46d7-8e3f-8bda872a09ed"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"7d19b10a-f645-46d7-8e3f-8bda872a09ed"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"7d19b10a-f645-46d7-8e3f-8bda872a09ed"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7d19b10a-f645-46d7-8e3f-8bda872a09ed"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"7d19b10a-f645-46d7-8e3f-8bda872a09ed"}],"recentChangeFlags":null},{"id":"05401b5c-295b-403a-a835-7f47aa84e308","uri":"https://www.vwfs.dk","name":"https://www.vwfs.dk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8108f3e8-b9fe-47c1-b716-9c4cbb9d0913","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"05401b5c-295b-403a-a835-7f47aa84e308"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"05401b5c-295b-403a-a835-7f47aa84e308"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"05401b5c-295b-403a-a835-7f47aa84e308"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"05401b5c-295b-403a-a835-7f47aa84e308"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"05401b5c-295b-403a-a835-7f47aa84e308"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"05401b5c-295b-403a-a835-7f47aa84e308"}],"recentChangeFlags":null},{"id":"4e35f496-6992-4a5e-9053-888e3cb8952d","uri":"https://www.vwfs.nl","name":"https://www.vwfs.nl","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e754c9c8-f104-4f83-ac7d-6a030b9ad517","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"4e35f496-6992-4a5e-9053-888e3cb8952d"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"4e35f496-6992-4a5e-9053-888e3cb8952d"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"4e35f496-6992-4a5e-9053-888e3cb8952d"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"4e35f496-6992-4a5e-9053-888e3cb8952d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4e35f496-6992-4a5e-9053-888e3cb8952d"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"4e35f496-6992-4a5e-9053-888e3cb8952d"}],"recentChangeFlags":null},{"id":"6c4e7721-79d8-4a18-9f7f-7626993032c6","uri":"https://www.vwfs.kr","name":"https://www.vwfs.kr","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"774b9d80-1264-48ea-bd9d-44ab5d7d6833","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"6c4e7721-79d8-4a18-9f7f-7626993032c6"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"6c4e7721-79d8-4a18-9f7f-7626993032c6"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"6c4e7721-79d8-4a18-9f7f-7626993032c6"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"6c4e7721-79d8-4a18-9f7f-7626993032c6"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6c4e7721-79d8-4a18-9f7f-7626993032c6"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"6c4e7721-79d8-4a18-9f7f-7626993032c6"}],"recentChangeFlags":null},{"id":"aed7470e-75b0-4e2c-b955-6674af84ff04","uri":"https://www.vwfs.com.tw","name":"https://www.vwfs.com.tw","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f78a88c3-9cf7-46b2-990d-6340b2569db5","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"aed7470e-75b0-4e2c-b955-6674af84ff04"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"aed7470e-75b0-4e2c-b955-6674af84ff04"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"aed7470e-75b0-4e2c-b955-6674af84ff04"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"aed7470e-75b0-4e2c-b955-6674af84ff04"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"aed7470e-75b0-4e2c-b955-6674af84ff04"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"aed7470e-75b0-4e2c-b955-6674af84ff04"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"48acfae9-ac88-4dac-8e90-f08b748e79f0","p1MaxCents":450000,"p1MinCents":350000,"p2MaxCents":250000,"p2MinCents":150000,"p3MaxCents":75000,"p3MinCents":50000,"p4MaxCents":22500,"p4MinCents":17500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch1\u003eTarget Information\u003c/h1\u003e\n\n\u003cp\u003e\u003cstrong\u003eDo not test on any other subdomains other than www. All submissions that are on other subdomains will be marked as Out-Of-Scope.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eNew Blue Websites (vwfs)\u003c/h2\u003e\n\n\u003cp\u003eThe NBW is an international platform for brand marketing websites that is used in a multitude of subsidiaries. It serves as marketing page and entry point for various further applications (such as banking and customer journey); sometimes, a subset of data is passed into these applications.\u003c/p\u003e\n\n\u003ch3\u003eFocus areas\u003c/h3\u003e\n\n\u003cp\u003eInjection of faulty/malicious data into the customer journeys; all attacks in which other customers are impaired.\u003c/p\u003e\n\n\u003ch3\u003eImportant\u003c/h3\u003e\n\n\u003cp\u003eAll apps within the scope utilize the same codebase, which means that any vulnerability discovered will be applicable to all apps. Therefore, we kindly request that you refrain from submitting multiple reports for each site, as they will be considered duplicates. Your cooperation in reporting just one instance is greatly appreciated.\u003c/p\u003e","rewardRangeData":{"1":{"min":3500,"max":4500},"2":{"min":1500,"max":2500},"3":{"min":500,"max":750},"4":{"min":175,"max":225},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"9b6839d4-9f02-4e98-a18f-4d361dda4cd9","code":"volkswagen-vwfs-mbb-og","state":"in_progress","endsAt":null,"bountyId":"8678adcd-f836-44e7-998e-b72794344554","startsAt":"2023-11-28T01:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/de75/0d23/2d3cf651/1dee97fd73edea076ef51be07e03ea27_volkswagen_financial_services_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-11-28T01:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/volkswagen-vwfs-mbb-og","changelogs":"/engagements/volkswagen-vwfs-mbb-og/changelog","submissions":null,"announcements":"/engagements/volkswagen-vwfs-mbb-og/announcements","hallOfFame":"/engagements/volkswagen-vwfs-mbb-og/hall_of_fames","crowdstream":"/engagements/volkswagen-vwfs-mbb-og/crowdstream"},"announcementsCount":3,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/volkswagen-vwfs-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=volkswagen-vwfs-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/volkswagen-vwfs-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/volkswagen-vwfs-mbb-og/changelog","publishedAt":"2025-10-28T07:34:21.694Z","engagementChangelogUrl":"/engagements/volkswagen-vwfs-mbb-og/changelog/b503b4ee-59b2-4fc5-8273-b7edb619462d","createUserFeedbacksUrl":"/engagements/volkswagen-vwfs-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/volkswagen-vwfs-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}