MyCrypto · Report #323566
Reflected XSS { support.mycrypto.com }
Validstatus
mediumseverity
6upvotes
2 Apr 2018disclosed
Summary
A reflected XSS was reported by sup3r-b0y that was activated by displaying unsanitized values of query parameters. The MyCrypto team worked with sup3r-b0y to identify and verify the fix, and are happy to confirm that the vulnerability described in the report has now been fixed. We are happy to continue to work with the HackerOne community to determine and resolve issues on an ongoing basis.
A big thank you to sup3r-b0y for their help in identifying and resolving this issue!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.