TikTok · Report #2178061
Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd]
Validstatus
mediumseverity
78upvotes
12 Jan 2024disclosed
Summary
A Cross-Site Scripting (XSS) vulnerability was found on TikTok incentive endpoint via x parameter, due to the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload could be injected into the affected endpoint causing it to be executed within the context of a user's browser. We thank @ashrafabdelrazik for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.