Loading HuntDB...

GetGlobalAchievementPercentagesForApp is missing the same release checks as GetSchemaForGame

Medium
V
Valve
Submitted None
Reported by xpaw

Vulnerability Details

Technical details and impact analysis

Information Disclosure
`GetGlobalAchievementPercentagesForApp` API method can be used to reveal achievement names/percentages for games that have not been released yet. This is not a problem with `GetSchemaForGame` method, which leads me to believe the other method is missing all the relevant checks. https://api.steampowered.com/ISteamUserStats/GetGlobalAchievementPercentagesForApp/v2/?gameid=██████ https://api.steampowered.com/ISteamUserStats/GetSchemaForGame/v1/?appid=████ `GetGlobalAchievementPercentagesForApp` should have the same release state checks as `GetSchemaForGame` as to not leak achievement names. ## Impact This can be used to reveal and leak work-in-progress achievements for games that have not been released yet.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Information Disclosure