Uber · Report #390386
Reflected XSS on https://www.uber.com
Validstatus
highseverity
114upvotes
15 Mar 2021disclosed
Summary
By getting an authenticated victim to visit a malicious website, an attacker can cause that victim to execute arbitrary JavaScript in the context of the uber.com domain.
More details here:
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.