4 ms·
Am I reading this right? 13,337 for a unrestricted file access vulnerability? Seems rather cheap, I think even other interested parties would pay more :/
by jotm 7y ago
Am I reading this right? 13,337 for a unrestricted file access vulnerability? Seems rather cheap, I think even other interested parties would pay more :/
- jchw 7y agoIt was treated as an unrestricted file access vulnerability. I don’t want to accidentally disclose any non-public information (as an employee of Google) so I’ll just say I suspect there wasn’t really a ton more to see other than status and debug pages. Not to downplay the value of such a vulnerability, just saying that with defense-in-depth risks like this should be relatively well contained. It sounds like they got access to some confidential operational information but were nowhere near user data, and there was no obvious path to get there without much worse vulnerabilities.