U.S. Dept Of Defense · Report #758854

Reflected Xss

Validstatus

mediumseverity

28upvotes

21 Sept 2020disclosed

How it was found

hello security team i found reflected XSS in this subdomain https://███

POC:- 1-go in subdomain 2-go here https://███████/en/embeddedAuthRedirect.html?auth=javascript:alert("xElkomy") 3-Done

Image:- ███████ #xElkomy

reflected cross-site scripting (XSS) operation with JavaScript, which runs in the client context. i can put malicious code in URL

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original