Mozilla · Report #1913263
HTML Injection at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net/user/unsubscribe
Validstatus
lowseverity
$500bounty
42upvotes
20 Oct 2023disclosed
How it was found
Hello,
The "Unsubscribe" page seems to be affected by Cross-Site Scripting (XSS) .Unfortunately my IP was blocked and I couldn't go ahead with the test to find a real proof of concept. So I'll just stick to this
POC:
Cheers
Impact
An attacker could use this to inject malicious client side code, such as JavaScript, and execute it within the context of another user. This could possibly lead to user account compromises, user’s being socially engineered and many more attacks against the application’s users.