3 ms·
The report describes a security breech in 2019; the report was held back until now for legal reasons: > Sunday May 5th > ...a login request is crafted to our
by sradman 6y ago
The report describes a security breech in 2019; the report was held back until now for legal reasons:
> Sunday May 5th
> ...a login request is crafted to our dev tier that is able to bypass the access controls limiting login to those users with an access key. The attacker is able to successfully log in to the development tier.
> Our dev tier was configured to allow impersonation of all users for testing purposes, and the attacker eventually finds a URL that allows them to elevate their privilege level to that of a Community Manager (CM). This level of access is a superset of the access available to site moderators.
EDIT: clarified that the report was held back
- kmontrose 6y agoThe breach itself was announced shortly after it was discovered: https://stackoverflow.blog/2019/05/16/security-update/ https://stackoverflow.blog/2019/05/16/security-update/ And affected users were notified once identified, which was shortly after the announcement: https://stackoverflow.blog/2019/05/17/update-to-security-incident-may-17-2019/ https://stackoverflow.blog/2019/05/17/update-to-security-inc... This is an update with more details, which was held back for legal reasons.
- sradman 6y agoYes, thank you. My wording was ambiguous; my bad.