[marketplace.informatica.com] Profile stored XSS

How it was found

The user name and lastname are inserted into JS with quotes non-escaped:

var pageNameDTM = "%name% %lastname%".replace(/[^a-zA-Z0-9 ]/g, "").replace(/  +/g, " ");

PoC:

1. Log into your account
2. Set your name and lastname to "-alert(document.domain)-"
3. Open your profile page https://marketplace.informatica.com/people/%email% from another account

The script will be executed:

{F142515}