Following the coordinated and responsible vulnerability disclosure guidelines of the **[ISO 29147]()** standard, Open Bug Bounty has:

a. verified the vulnerability and confirmed its existence;
b. notified the website operator about its existence.

Affected Website:| **[defesa.gov.pt]() **
—|—
Open Bug Bounty Program:| **Create your bounty program now**. It’s open and free.
Vulnerable Application:| Custom Code
Vulnerability Type:| **[IAC (Improper Access Control)]()** / CWE-284
CVSSv3 Score:| 6.5 [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N]
Disclosure Standard:| Coordinated Disclosure based on **[ISO 29147]()** guidelines
Discovered and Reported by:| **MiguelSantareno **
Remediation Guide:| **[OWASP Access Control Cheat Sheet]()**
Export Vulnerability Data:| Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

https: //mw.defesa.gov.pt/_vti_bin/Lists.asmx?WSDL
—

**Mirror:** [Click here to view the mirror]()

### Coordinated Disclosure Timeline

Vulnerability Reported:| 13 December, 2019 10:24 GMT
—|—
Vulnerability Verified:| 16 December, 2019 07:23 GMT
Website Operator Notified:| 16 December, 2019 07:23 GMT
a. Using the ISO 29147 guidelines| 
—|—
b. Using publicly available security contacts| 
c. Using Open Bug Bounty notification framework| 
d. Using security contacts provided by the researcher| 
x. Using Twitter notification| 
Public Report Published [without technical details]:| 16 December, 2019 07:23 GMT
Vulnerability Fixed:| 30 December, 2021 12:11 GMT
—|—Read More