Cvent Bug Bounty

Description

About Cvent provides easy-to-use, integrated technology solutions to maximize the impact of meetings and events of all sizes. We help organizations plan and market events, execute onsite, engage audiences, and measure and analyze results. Cvent recognizes that the security community is a catalyst in our quest to provide a safe and secure experience to our customers. At Cvent, we take security seriously and therefore, we welcome any responsible disclosure of potential security findings in our products. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. Note that the final risk rating will be determined by Cvent Security Team. .

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Cvent not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Cvent, you can report it to https://www.cvent.com/en/event-management-software/vulnerability-disclosure-program. However, be aware that it is ineligible for rewards or points-based compensation. Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see (https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/) Rules, Exclusions, and Scopes Any domain/property of Cvent not listed in the targets section is strictly out of scope (for more information please see the out of scope and exclusions sections below). Out-of-Scope Alpha, beta and lower region versions of our applications. The use of Automated scanners is strictly prohibited (we already used these tools in our normal security process no need to test with these). Cvent Networks and physical infrastructure is also out of scope. Excluded Submission Types Cvent's Bug Bounty program follows Bugcrowd’s Vulnerability Rating Taxonomy with some additional vulnerability classes we consider to be excluded below: Distributed Denial of Service attacks and Denial of Service attacks. HTML Editor Related Issues - Any issue that is a result of exploiting the the HTML Editor features offered in Cvent applications. (eg XSS, Content Injection, Content spoofing, Text Injection etc.) Missing Security Headers Missing cookie flags on non-sensitive cookies Logout and other instances of low-severity Cross-Site Request Forgery Open redirects with low security impact (exceptions are those cases where the impact is higher such as stealing OAuth tokens) Password and account recovery policies, such as reset link expiration or password complexity Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM) OR Mail Server Domain Misconfiguration (including email spoofing, missing DMARC, SPF/DKIM, etc.) Missing best practices in SSL/TLS configuration. Clickjacking/UI redressing with no practical security impact Software version disclosure Username / email enumeration via Login Page or Forgot Password Page error messages Comma Separated Values (CSV) injection without demonstrating a vulnerability. Use of known-vulnerable libraries without proof of exploitation, e.g. OpenSSL Attacks requiring MITM or physical access to a user’s device. Vulnerabilities that require disabling security features enabled in default configurations. Email triggering due to the lack of rate limiting. Older versions of our applications (especially for mobile application versions) Physical Testing Social Engineering For example, attempts to steal cookies, fake login pages to collect credentials Phishing Weak Captcha / Captcha bypass Cookie / Session valid after password change/reset Issues related to cross-domain policies for software such as flash, silverlight etc. without evidence of an exploitable vulnerability Vulnerability reports that require a large amount of user cooperation to perform, unlikely or unreasonable actions which would be more symptomatic of a social engineering or phishing attack and not an application vulnerability (e.g. disabling browser security features, sending the attacker critical information to complete the attack, guiding the user through a particular flow and requiring them to enter malicious code themselves, etc.) Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. SSL/TLS Issues, e.g. SSL Attacks such as BEAST, BREACH, Renegotiation attack. SSL Forward secrecy not enabled. SSL weak/insecure cipher suites. The ability to upload/download viruses or malicious files to the platform The use of Automated scanners is strictly prohibited. Lack of Mobile binary protections (eg Lack of Jailbreak/Root detection mechanism or lack of code obfuscation) Concurrent User sessions Long or Insufficient Session Expiration Durations. Google API keys embedded within mobile binaries. Public Disclosure We are pleased to thank every researcher who submits valid reports that help us improve the security of Cvent products. While Cvent shall continue to reward valid security submissions, Cvent does not permit public disclosure or any other types of disclosure at this point. NO EXCEPTIONS to this policy until any official announcement from Cvent via the BugCrowd platform. Cvent's existing Vulnerability Disclosure Program (https://www.cvent.com/en/event-management-software/vulnerability-disclosure-program) remains in place and continues to be the channel for our customers and security researchers not part of the vetted Bug Bounty program to report security concerns directly to Cvent. The VDP also remains the right path for any findings that fall outside the scope of the new Bug Bounty program. Terms and Conditions Please use your own account for testing or research purposes. Do not attempt to gain access to another user’s account or confidential information. Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged. Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced). Multiple vulnerabilities caused by one underlying issue will be treated as one valid report. Social engineering (e.g. phishing, vishing, smishing) is prohibited. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. Please do not test for spam, social engineering, or denial of service issues. Please do not engage in any activity that can potentially or actually cause harm to Cvent, our customers, or our employees. Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where (i) data, assets, or systems reside, (ii) data traffic is routed, or (iii) the researcher is conducting research activity. Do not store, share, compromise, or destroy Cvent or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact Cvent This step protects any potentially vulnerable data, and you. (This may apply to safe harbor) General Conduct Use your own account for testing or research purposes. Do not attempt to gain access to another user's account or confidential information. To ensure uninterrupted access and avoid rate-limiting or blocking during your testing, please include the following custom HTTP header in all of your requests: X-Bug-Bounty: This helps us identify legitimate testing traffic and prevent accidental interference with real users. If you have had professional access to Cvent systems in any capacity within the last 12 months, you must disclose this before submitting a report. Make sure emails come from @bugcrowdninja.com. Provide detailed reports with reproducible steps. Submit one vulnerability per report, unless chaining is needed to provide impact. When duplicates occur, we only triage the first report received. Multiple vulnerabilities caused by one underlying issue will be treated as one valid report. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Prohibited Activities: Social engineering (e.g. phishing, vishing, smishing) is prohibited. Do not test for spam, social engineering, or denial of service issues. Do not engage in any activity that can potentially or actually cause harm to Cvent, our customers, or our employees. Do not engage in any activity that violates federal or state laws or regulations. Do not store, share, compromise, or destroy Cvent or customer data. If PII is encountered, immediately halt activity, purge related data, and contact Cvent at [email protected] within 24 hours. Safe Harbor and Authorization Cvent expressly authorizes security testing of in-scope systems solely as described in this policy. Provided research is conducted in good faith and in compliance with these terms, Cvent will not pursue civil or criminal legal action. Researchers operating from U.S. OFAC-sanctioned jurisdictions are not eligible to participate or receive rewards. Automated Testing and AI Tools The use of automated scanners is strictly prohibited. High-volume automated or AI-driven testing must stay within normal rate limits. AI tools are permitted for research, but must respect scope and rate limits. If AI tools were used materially to discover a vulnerability, note this in your report. We do not accept low-effort or AI-generated content. Submissions must demonstrate original analysis. Data and Confidentiality Data obtained from this program may not be used to train publicly hosted AI models or shared with third parties. Public disclosure of any vulnerability or program details is not permitted. Cvent's existing Vulnerability Disclosure Program (VDP) - (https://www.cvent.com/en/event-management-software/vulnerability-disclosure-program) remains in place and continues to be the channel to report security concerns directly to Cvent. The VDP also remains the right path for any findings that fall outside the scope of the new public Bug Bounty program.