4 ms·
> 2021-12-03 08:42: Jordy tweets and deletes about “read arbitrary files on the host, no authentication needed” (Editor’s note: We were not aware of this until
by WoahNoun 5y ago
> 2021-12-03 08:42: Jordy tweets and deletes about “read arbitrary files on the host, no authentication needed” (Editor’s note: We were not aware of this until 2021-12-07.)
Doesn't quite sound like an "ethical hacker" to me.
- RichiH 5y agoI talked to Jordy about it. It was his first CVSS HIGH vulnerability and he was super happy & excited about it. While we would have preferred if things went differently, it was an honest mistake. On balance, I still prefer if someone approaches us with good intentions and messes up a bit over someone simply dumping a 0day into the wild or into private circles. And this way, we at least had a tested patch in hand already and knew that Grafana Cloud was not affected. And as per https://news.ycombinator.com/item?id=29495431 https://news.ycombinator.com/item?id=29495431 ... we all make mistakes.
- tomsioncati 5y agoEchoing this. It was a good find and well intended. We'll welcome any future submissions from Jordy.