Uber · Report #191810
Reflected XSS in lert.uber.com
Validstatus
mediumseverity
39upvotes
19 Dec 2018disclosed
Summary
Due to a lack of input validation from the search field on lert.uber.com, it was possible to obtain a Reflected XSS from the URL path, e.g. https://lert.uber.com/s/search/All/Home">PAYLOAD.
Thanks, @hussain_0x3c!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.