Date: Mon, 5 Jan 2015 14:12:35 -0600 From: Simo Ben youssef <simo@...xploit.com> To: Korvin Szanto <Korvin@...tlandlabs.com> Cc: Henri Salo <henri@...v.fi>, oss-security@...ts.openwall.com, cve-assign@...re.org, abuse@...crete5.org, security@...crete5.org, Simo Ben youssef <simo@...xploit.com> Subject: Re: CVE request: Concrete5 XSS vulnerability Korvin, You need to get your facts right before pointing fingers. First of all and as we stated in our advisory on the 9th of December 2014, the vulnerabilities were discovered on the 2nd of November 2014 to affect 5.7.2 (and 220.127.116.11 later on December) which was the the latest version at that time (As downloaded from concrete5.org). The fix on your github was pushed on the 10th of December 2014, a day after we published our advisory on FD and Bugtraq. You accuse us of being irresponsible and unprofessional for not disclosing the vulnerabilities to you first and it's not true since we contacted you twice through your security program at HackerOne (Report #33848) which hasn't been even "triaged" yet. I think what's really unprofessional is your inability to monitor your own security programs while putting the blame on people who reach out to you to help you fix your flaws. On Mon, Jan 5, 2015 at 11:56 AM, Korvin Szanto <Korvin@...tlandlabs.com> wrote: > This has been fixed in 5.7.3 for some time > > https://github.com/concrete5/concrete5-5.7.0/commit/e3d47d2af88ddef36deaf754ef22f1f39b9b623b > > We have a security disclosure program for this so any disclosure > outside of our program is very irresponsible and unprofessional. You > end up with outdated information and leave us unable to fix the issue > in a secure way since we cannot see it until it's brought to our > attention through our disclosure program. > > On Fri, Jan 2, 2015 at 11:43 AM, Henri Salo <henri@...v.fi> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Can you assign CVE identifier for following vulnerability in Concrete5, > thanks. > > > > http://seclists.org/bugtraq/2014/Dec/53 > > http://osvdb.org/115633 > > http://osvdb.org/115634 > > > > ps. there is something wrong with > http://www.openwall.com/lists/oss-security/ it > > says "an error occurred while processing this directive" > > > > - -- > > Henri Salo > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.12 (GNU/Linux) > > > > iEYEARECAAYFAlSm9P4ACgkQXf6hBi6kbk+bfQCgjF/EWeO4Wfs0SUSsq96LwNpE > > AWAAn1yKEw9eDAlJ6cQczjzHZ7VGdXUp > > =0mVH > > -----END PGP SIGNATURE----- > -- Simo Ben youssef Vulnerability Research Engineer O: (708) 629-6922 M: (312) 725-8043 MorXploit Research www.morxploit.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.