Fiverr Cloudinary Misconfiguration Exposed 30,000 PDFs to Google
Summary
A report says more than 30,000 Fiverr PDF links hosted on Cloudinary were indexed by Google because the URLs did not expire or require authentication, exposing documents that reportedly included taxpayer information.
Key points
- The article reports that Google indexed more than 30,000 links to Fiverr PDF deliverables hosted on Cloudinary.
- The URLs were public, did not expire and required no authentication, according to the report.
- The exposed documents reportedly included client details and forms containing taxpayer information.
- The article says independent verification confirmed the indexing, but does not describe the verification method.
- A researcher reportedly received no acknowledgment from Fiverr for over 40 days after reporting the issue; the article says it remained unresolved.
Article Details
- Victim Organization
- Fiverr
- Incident Type
- Sensitive PDF documents were publicly accessible through non-expiring Cloudinary URLs without authentication and were indexed by Google Search.
- Data Types Exposed
- PDF task deliverables
- Proprietary client details
- Taxpayer information
- Sensitive personal information
- Affected Records
- More than 30,000 links were indexed; the number of distinct affected documents or records was not specified.
- Operational Impact
- Documents shared between buyers and freelancers became publicly discoverable. The article reports no operational disruption; the exposure remained unresolved at publication.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Vendors
Products
FiverrA security researcher revealed that over 30,000 Fiverr PDF task files were indexed by Google after public-facing Cloudinary URLs used by Fiverr were left accessible without expiration or authentication.Google SearchMore than 30,000 Cloudinary links to Fiverr PDF deliverables were indexed by Google Search.