1

This question already has an answer here:

I couldn't find any other post on stack exchange talking about this.

I have found a way to get a website to list all users and their names. Is this considered a vulnerability? This website does have a bug bounty.

I think this might be a vulnerability, because an attacker could enumerate the user list and test the top 3 passwords or something, then switch to another proxy and try the next account. I don't know if this is worth reporting or not, however.

So here are my questions: Is this a vulnerability? What is its severity? Is it worth reporting? And if it is a vulnerability, what other ways could someone exploit this?

Edit: This question is talking about actually being able to list every single user and their names. Not just being able to check whether or not a user exists. I don't know how to "unmark" this as a duplicate.

marked as duplicate by Arminius, Xiong Chiamiov, Rory Alsop Jun 2 '17 at 18:56

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • this is definitely a vulnerability and worth reporting! – NtFreX Jun 2 '17 at 18:20
  • 1
    We have tons of questions about username enumeration. E.g. this, this and this. – Arminius Jun 2 '17 at 18:21
  • 1
    @Arminius arent those questions all about if its secure to show that a user exists after the username has been entered? This questions seems to be about a issue where he can list all users. – NtFreX Jun 2 '17 at 19:06
  • @Dr.Fre In my opinion, the arguments in that case aren't fundamentally different. But if you think that's a separate issue that justifies an individual question, you might want to emphasize this aspect in the question and ask for a reopen. – Arminius Jun 2 '17 at 19:39
  • 1
    Oh sorry, I just realized I was commenting from my second account. The @Arin user is me. – user149925 Jun 3 '17 at 23:01