Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv

High

Vimeo

Submitted None

Team Summary

Official summary from Vimeo

By modifying the Content-Type to be blank, during a PUT command, the researcher was able to upload files to the CDN. This has been resolved.

Actions:

Reported by sp1d3rs

Additional information and metadata

Closed

Resolved

Improper Access Control - Generic