▲ 23 ▼ (URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works (sh.itjust.works) submitted 3 years ago* by polskilumalo@lemmygrad.ml to c/genzedong@lemmygrad.ml 10 comments fedilink hide all child comments Both lemmy.world and lemmy.blahaj.zone are both down, this issue IS URGENT as this could be why they are both down. @CriticalResist8@lemmygrad.ml @muad_dibber@lemmygrad.ml @CaptCalhoun@lemmygrad.ml @Farmer_Heck@lemmygrad.ml @felipeforte@lemmygrad.ml @ksynwa@lemmygrad.ml
[–] sovietsnake@lemmygrad.ml 3 points 3 years ago (2 children) Don't post this kind of things, the less attention the better, communicate with developers in a private way and let them know about vulnerabilities. permalink fedilink source hideshow 4 child comments replies: [–] darkcalling@lemmygrad.ml 11 points 3 years ago* (last edited 3 years ago) It's being actively exploited in the wild as we speak. Private disclosure is only useful and necessary when vulnerabilities are not being actively exploited or if they are exceptionally technically difficult requiring very specific conditions and you are disclosing specifically those conditions which might enable additional exploitation before a fix. However, this is a technically simple exploit, disclosing it exists will not enable more attackers. It is responsible in situations where something is being actively exploited, it is a simple exploit, etc to discuss, inform, and yes let others who may want to patch themselves have the knowledge needed to patch when devs are asleep or otherwise unable to act expediently. permalink fedilink source parent [–] polskilumalo@lemmygrad.ml [S] 10 points 3 years ago* I posted it this way because it was already public, even detailing how the vulnerability worked on github, and because I thought of informing as many as possible. I should've explicitly stated this, but I hoped this would encourage logging off (we seriously need a log off emoji) and possibly changing your password later to remedy this. permalink fedilink source parent
[–] darkcalling@lemmygrad.ml 11 points 3 years ago* (last edited 3 years ago) It's being actively exploited in the wild as we speak. Private disclosure is only useful and necessary when vulnerabilities are not being actively exploited or if they are exceptionally technically difficult requiring very specific conditions and you are disclosing specifically those conditions which might enable additional exploitation before a fix. However, this is a technically simple exploit, disclosing it exists will not enable more attackers. It is responsible in situations where something is being actively exploited, it is a simple exploit, etc to discuss, inform, and yes let others who may want to patch themselves have the knowledge needed to patch when devs are asleep or otherwise unable to act expediently. permalink fedilink source parent
[–] polskilumalo@lemmygrad.ml [S] 10 points 3 years ago* I posted it this way because it was already public, even detailing how the vulnerability worked on github, and because I thought of informing as many as possible. I should've explicitly stated this, but I hoped this would encourage logging off (we seriously need a log off emoji) and possibly changing your password later to remedy this. permalink fedilink source parent