Currently OLX is working on the mitigation of this vulnerability. All API endpoints are being reviewed by dedicated resources and fixed under high urgency.

Actions:

View on HackerOne

Reported by lukeberner

Vulnerability Details

Technical details and impact analysis

Information Disclosure

Hi, Through api-v2/items you can list all information of users (except email). As items are sequential, you can just make a script that crawls items from: https://www.olx.com.ar/api-v2/items/822200000 to https://www.olx.com.ar/api-v2/items/901858309 Example of sensible user information from random curl: ``` ██████████ ``` ``` █████████ ``` Example of random curl: ``` $ curl https://www.olx.com.ar/api-v2/items/822200000 ██████████ ``` Let me know if you need anything else. Cheers, Luke.-

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Information Disclosure