Lark Technologies · Report #884931
Stored xss in larksuite internal helpdesk and other user's helpdesk.
Validstatus
mediumseverity
13upvotes
19 Feb 2021disclosed
Summary
A stored XSS (cross site scripting) vulnerability was found which an attacker could have potentially used to obtain access to the internal team's help desk and view submitted user tickets. We have resolved this issue and thank @imran_nisar for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.