full-disclosure - VMWare Manage Subscriptions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 05 Apr 2011 18:03:04 +0800
From: p8x <l@....net>
To: full-disclosure@...ts.grok.org.uk
Subject: VMWare Manage Subscriptions - Info Disclosure

Hi all,

Not really sure if this is an intended feature but I decided to 
unsubscribe from the VMWare Newsletters that get sent out today. You get 
sent to the following address to unsubscribe:

http://info.vmware.com/content/opt-out?elq=[UNIQUE ID]

The ID provided in the URL looks like it is to just pre-fill the form, 
and the elq parameter can be left off completely. If you fill out the 
form with *any* email address that has a VMWare account there does not 
appear to be any validation to see if you are the actual owner. You are 
then able to click "Profile Management" at the top of the page and you 
can then see the details that the user filled in during registration.

This may be intended, but I find it unusual that "personal" details are 
disclosed without any verification...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/