Autodesk · Report #2971572
Stored Cross-Site Scripting found in custom integration app on https://admin.b360.autodesk.com.
Validstatus
mediumseverity
127upvotes
14 Mar 2025disclosed
Summary
A stored cross-site scripting (XSS) vulnerability was found in Autodesk's Custom Integration feature on the admin panel at admin.b360.autodesk.com, which could have allowed an attacker to inject malicious JavaScript code when viewed by users. Autodesk has fixed the vulnerability and we thank @the-white-evil for reporting this issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.