Informatica · Report #81191
[now.informatica.com] Reflective Xss
Validstatus
highseverity
6upvotes
19 May 2016disclosed
Summary
Company look up end point didn't properly sanitize input allowing XSS. Typically this isn't very dangerous but the lack of CSRF tokens meant that an attacker would be able to craft a landing page that would be able to perform actions without the user knowledge
How it was found
http://now.informatica.com/en_data-integration-for-dummies_book_2642.html?source=Homepage The issue is located here. I will be including a video demonstrating this vulnerability Xss vector used: <svg onload=confirm(document.domain)>xs