Automattic · Report #1100096
SSRF & Blind XSS in Gravatar email
Validstatus
highseverity
34upvotes
17 Jan 2022disclosed
Summary
Nathan Cavitt (rockybandana) reported a blind XSS issue in the Gravatar service, which was due to incorrect/insufficient sanitization on adding emails to one's profile. The report was of good quality and the issue was fixed within a couple of days of report.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.