Omnicell

Response Targets

Omnicell Corporation will make reasonable efforts to meet the following response targets for researchers participating in our program:

• Time to first response from report submission: 3 business days.
• Time to triage from report submission: 3 business days.

We will also make reasonable efforts to keep you updated on our progress throughout the process.

Disclosure Policy

• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Program Rules

• Please submit detailed reports that include reproducible steps. Reports that do not contain enough detail to reproduce the issue will not be eligible for a reward.
• Provide technical details of the vulnerability or concern, such as:

  • URLs or systems impacted, including software version, if applicable

  • Additional information that will be helpful to us such as details of testing environment and tools used to discover vulnerabilities

  • Discovery method, when, where, how

• Submit one vulnerability per report, unless multiple vulnerabilities must be chained together to demonstrate impact.
• In the event of duplicate reports, only the first report received will be eligible for an award, provided the issue can be fully reproduced.
• Multiple vulnerabilities that stem from a single underlying root cause will be eligible for a single acknowledgment only.
• Social engineering, including phishing, vishing, and smishing, is prohibited.
• Act in good faith to avoid privacy violations, data destruction, and service interruption or degradation. Only interact with accounts you own or for which you have the account holder’s explicit permission.
• Test devices will not be provided.
• Keep requests to Omnicell web servers to a minimum.
• Omnicell Employees or contractors (past and current) and their associates/family members are not eligible.

Out of Scope Vulnerabilities

When submitting vulnerability reports, please consider both the attack scenario or exploitability and the security impact of the issue. The following are considered out of scope:

• Clickjacking on pages that do not perform sensitive actions.

• Unauthenticated, logout, or login CSRF.

• Attacks that require a machine-in-the-middle position or physical access to a user’s device.

• Previously known vulnerable libraries without a working proof of concept.

• CSV injection without a demonstrated vulnerability impact.

• Missing SSL/TLS best-practice configurations including weak cipher suites, TLS versions.

• Minor CORS misconfiguration without data exposure.

• Any activity that could disrupt service availability, including DoS.

• Content spoofing or text injection issues that do not demonstrate an attack vector or the ability to modify HTML/CSS.

• Rate-limiting or brute-force issues on non-authentication endpoints.

• Missing Content Security Policy best practices.

• Missing HttpOnly or Secure cookie flags.

• Missing email security best practices, including invalid, incomplete, or missing SPF, DKIM, or DMARC records.

• Vulnerabilities that affect only outdated or unpatched browsers that are fewer than two stable versions behind the latest stable release.

• Software version disclosure, banner identification issues, or descriptive error messages and headers, such as stack traces, application errors, or server errors.

• Public zero-day vulnerabilities with an official patch available for less than one month; these may be considered on a case-by-case basis.

• Open redirects unless additional security impact can be demonstrated.

• Issues that depend on unlikely user interaction.

• Issues in third-party services such as bugs in Cloud providers (AWS, Azure, GCP), embedded widget.

Unauthorized Conduct

This policy is designed to be compatible with common vulnerability disclosure good practice. Researchers shall disclose potential vulnerabilities in accordance with the following guidelines:

• Do not engage in any activity that can potentially or actually cause harm to Omnicell, our customers, our employees, or any third-party.
• Do not engage in any activity that can potentially or actually stop or degrade Omnicell services or assets.
• Do not perform automated scanning or testing.
• Do not store, share, compromise or destroy Omnicell or third-party data, including data of individuals. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from

your system, and immediately contact Omnicell. This step protects any potentially vulnerable data and you.

• Provide Omnicell reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly.
• Hack, penetrate, or otherwise attempt to gain unauthorized access to Omnicell or third-party applications, systems, or data.
• Download, copy, disclose, corrupt, or prevent access or use any proprietary or confidential Omnicell or third-party data, including customer data.
• Adversely impact Omnicell or third-party the operation of Omnicell applications or systems.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Omnicell Corporation and our users safe!