Meetup vulnerabilities enabled group takeovers, payment redirections

guest · Aug 3, 2020

Meetup vulnerabilities enabled group takeovers, payment redirections
August 3, 2020
https://www.helpnetsecurity.com/2020/08/03/meetup-vulnerabilities/

Two high-risk vulnerabilities in Meetup, a popular online service that’s used to create groups that host local in-person events, allowed attackers to easily take over any Meetup group, access all group functions and assets, and redirect all Meetup payments/financial transactions to their PayPal account (some Meetup events are free, but some are not).

What’s more, attackers could create a worm to take over all meetings on the site – including private ones – and do all of these things.
About the Meetup vulnerabilities
Checkmarx researchers, who were searching for API security issues in high-profile web applications, discovered two privacy-busting API flaws on Meetup.com [...]
Click to expand...

The good news
Meetup has been appraised of the findings and has fixed all the flaws discovered by Checkmarx researchers, including the two flaws that could allow attackers to enumerate Meetup users and retrieve sensitive information about them.
Click to expand...

Checkmarx: Privilege Escalation on Meetup.com Enabled Redirection of Payments

Impact Summary

Take over any Meetup group by role escalation

Access all group functions and assets (members’ details, edit group settings, fake event creation, etc.)

Redirect all payments to any PayPal account

Click to expand...

Log in or Sign up

Meetup vulnerabilities enabled group takeovers, payment redirections

guest Guest

Log in or Sign up

Meetup vulnerabilities enabled group takeovers, payment redirections

guest Guest

Useful Searches