HexBrain

U.S. Dept Of Defense · Report #1267380

Reflected XSS on [█████████]

Validstatus
mediumseverity
10upvotes
7 Apr 2022disclosed

How it was found

Summary:

Hi security team members,

I found a reflected XSS on the URL

Impact

  1. An attacker can steal the victim's cookies.
  2. An attacker can execute JS code.

System Host(s)

█████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

  1. Navigate to this link:- https://██████████/██████=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
  2. Then, it will execute.

Suggested Mitigation/Remediation Actions

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original