Visma delivers software that simplifies and digitizes core business processes in the private and public sector. With presence across the entire Nordic region along with Benelux, Central and Eastern Europe, we are one of Europe’s leading software companies. We want to engage with responsible security researchers around the globe to further secure our services. This program is dedicated for all Visma assets (services, products, web properties).
This is a responsible disclosure program without bounties.
To encourage vulnerability research and to avoid any confusion between good-faith hacking and malicious attack, by participating in this program, you agree to the following program rules.
When working with us according to this policy, you can expect us to:
This program covers all Visma services, products or web properties.
We do not offer money rewards for this program, but as a small token of appreciation for all researchers that submit a previously unknown vulnerability that triggers a code or configuration change, we will offer a place on our Security Hall of Fame (HoF).
Also for all valid Medium+ reports, we will offer swags.
For money rewards, the only exceptions are the specific assets listed in our Public Bug Bounty Program, see https://app.intigriti.com/programs/visma/visma/detail. Please note that we will only accept reports for the explicitly listed assets under our Public program.
This program covers all Visma services, products or web properties.
Please note! Most reports we receive have little or no security impact or are already known. To avoid a disappointing experience when reporting us, please take a moment and consider if the issue you want to report actually has a realistic attack scenario.
We ask you to not submit issues regarding:
We will always take into consideration the business impact and security impact when setting the final severity of the reports, so in case there's no impact, the report will not be accepted.
When duplicates occur, we will only accept the first report. A duplicate is a vulnerability that we are already aware of, regardless of how we first became aware of it (it could have also been discovered by us internally).
To get an idea of how we define severities, see the following table as a guideline, but please know that the severity may be adjusted depending on the actual business impact:
| Severity | Vulnerability |
|---|---|
| Exceptional | A quality report that shows exceptional impact to Visma and it's customers, typically otherwise in high or critical severity category |
| Critical | Remote Code Execution (RCE) |
| Critical | SQL Injection (SQLi) |
| Critical | Authentication or Authorization Bypass |
| High | Local File Inclusion |
| High | Account Takeover |
| High | Mass PII Extraction |
| High | Horizontal Privilege Escalation across customer contexts |
| High | Vertical Privilege Escalation |
| High | XML External Entity Injection (XXE) |
| Medium | Insecure Direct Object Reference (IDOR) |
| Medium | Horizontal Privilege Escalation within the same customer context |
| Medium | Server-Side Request Forgery (SSRF) |
| Medium | Reflected Cross-Site Scripting |
| Medium | Stored Cross-Site Scripting (XSS) |
| Medium | DOM-based Cross-Site Scripting |
| Medium | Cross-Site Request Forgery (CSRF) |
| Medium | Sensitive Data Exposure |
| Medium | Cross-Site Script Inclusion (XSSI) |
| Low | GUID-based IDOR |
| Low | Mass User Enumeration (without brute-forcing) |
| Low | Clear text Submission of Passwords (over HTTP) |
| Low | Open Redirect |
| Low | HTML content injection |
| Low | Broken Link Hijacking |
| Low | PHP Info Disclosure |
| Low | Rate limit issues on authentication endpoints |
| Informative | Non-State Changing Cross-Site Request Forgery |
| Informative | CSV/formula injection |
| Informative | Server Information Page |
| Informative | User Enumeration including WordPress Mass User Enumeration |
| Out of scope | Text (non-html) content injection |
| Out of scope | Non-Sensitive Data Disclosure |
| Out of scope | Lack of, or weak, security headers |
| Out of scope | Flash based CSRF |
| Out of scope | DoS & DDoS |
No credentials provided for this program. In case you register accounts, please use your @intigriti.me address so that we can track researchers in our production environments.
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
