TikTok · Report #1549451
DOM XSS on ads.tiktok.com
Validstatus
mediumseverity
$2,500bounty
104upvotes
20 Jul 2022disclosed
Summary
A Cross-Site Scripting (XSS) vulnerability was found on a TikTok Ads endpoint via the "settings" parameter, caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. We thank @0x7 for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.