Rockstar Games · Report #231389
Stored XSS in snapmatic comments
Validstatus
mediumseverity
$1,000bounty
30upvotes
5 Sept 2017disclosed
Summary
In this report, the researcher found that we were not filtering ＜ and ＞ characters the same as < and >. This allowed the researcher to craft XSS POCs that bypassed our filters, particularly on UGC comments. We have updated our filters to amend this oversight.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.