Autodesk · Report #3008066
Stored XSS in AREA tutorials
Validstatus
highseverity
73upvotes
25 Aug 2025disclosed
Summary
A stored cross-site scripting (XSS) vulnerability was found on AREA, which could have allowed an attacker to inject malicious JavaScript code when publishing a tutorial. Autodesk has fixed the vulnerability and we thank @who_am_i_ for reporting this issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.