[GSD-2023-1001657] GSD Request

[GSD-automation]

--- GSD JSON ---
{
  "vendor_name": "ZeroSSL",
  "product_name": "website",
  "product_version": "all current versions",
  "vulnerability_type": "XSS",
  "affected_component": "https://app.zerossl.com",
  "attack_vector": "phishing",
  "impact": "Theft of private certificate keys, hashed password and/or session hijacking",
  "credit": "mail@michalspacek.cz",
  "references": [
    "https://groups.google.com/a/ccadb.org/g/public/c/kqtoGeEv5Fc"
  ],
  "reporter": "kurtseifried",
  "reporter_id": 582211,
  "notes": "",
  "description": "In the ZeroSSL website https://app.zerossl.com an XSS exists in it that can be attacked via phishing resulting in theft of private certificate keys, hashed password and/or session hijacking. It is not clear if the vendor has fixed this issue or not at this time."
}
--- GSD JSON ---

/cc @kurtseifried

[GSD-automation]

This issue has been assigned GSD-2023-1001657