Respondly · Report #8010

XSS via Email Link

Validstatus

4upvotes

21 Apr 2014disclosed

How it was found

Hey,

So, we can send emails to team email address like - [email protected] . In the email body if there is a hyperlink pointing to javascript:alert(0); or any other javascript: URI then open viewing the email in your web application with original HTML view and then on clicking it will trigger javascript execution, that is XSS.

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original