amundi-m1st-bug-bounty-program
5
In Scope
2
Out of Scope
In-Scope Assets (5)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| https://preprod.amundi-ee.com/psf-cms/mobile/MonEpargne-ppr.apk | ANDROID | Yes | - | |
| https://preprod.epargnant.amundi-ee.com | URL | Yes | ||
| https://preprod.epargnant.amundi-ee.com/api | URL | Yes | ||
| https://preprod.epargnant.amundi-ee.com/public | URL | Yes | ||
| https://testflight.apple.com/join/uCyHVKBp | IOS | Yes | - |
Out-of-Scope Assets (2)
| Asset | Category | Bounty | |
|---|---|---|---|
| - All domains or subdomains not listed in the above list of 'Scopes' | OTHER | Yes | |
| - The following Endpoint /courrier/documentAttache/{idDocument}/jetonDownload is vulnerable to IDOR (Insecure direct object references) where there is no permission check, and allow a user to generate a token to download any document by guessing just its ID (query param idDocument). So this issue will be marked as out-of-scope and won't be eligible in our program for a bounty. | OTHER | Yes |