Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed
Medium
L
LinkedIn
Submitted None
Team Summary
Official summary from LinkedIn
The researcher found an IDOR in LinkedIn Skill Test functionality which allowed anyone to view the private skill test results of users who failed to earn a badge and also test results of a passed skill test kept private.
Actions:
Reported by
marvelmaniac
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Insecure Direct Object Reference (IDOR)