Re: Bug Report [critical]
Boyuan Yang <[email protected]>
| Newsgroups | gmane.linux.debian.devel.www |
|---|---|
| Organization | Debian Project |
| Message-ID | <[email protected]> |
hi, 在 2023-05-03星期三的 01:50 +0600，ovix security写道： > Hi Team, > I have found a vulnerability in context to publicly > accessible Jenkins dashboard leaks user/employee data due to asynchPeople > people Enabled. > > Description: > Due to the publicly exposed Jenkins Dashboard I was able to see > user/employee data also project data.source code etc etc > > Steps to Reproduce : > 1) Go to " https://azure-build.debian.net/asynchPeople/ " (Your company > owned) > > > 2) You can see the large list of employee/user data and user id. > > Impact: > Sensitive Data Leak publicly > The access also included some source code disclosure Thanks for the report, but all user data, user ID and source code at least on this website are obviously intended to be public from the very beginning. I do not see data leak problem here. Thanks, Boyuan Yang
signature.asc
(application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEfncpR22H1vEdkazLwpPntGGCWs4FAmRSq9IACgkQwpPntGGC Ws4ivBAAoq0CZo5+41qb++0ZKGWlDtdyN6M+Y8BqZ0xPIeb5ky/QqbFEIiYuCFCF JXevKfWNn0GIwxWtr4qjZZvHeYdaQdQYV/rS8nk5loFRritqdbwV/4yHxXoYU2nn ZcoeFNJdIvxM8JEqOrwPLm1wEnDmUo1SGncgpLy7AHj2FO2xnR+YcdS6IGgxKOQU gld7MDBZn1BwQpCgZDyshp7N1hekCdhFxNE7hveSUxXpslO1CpDNHeOUAySHktQC XrMzQAonpZeBK976yTdSandEd6U6BUvF/BH/cybpXOfQgZhqsubv4dZX+Lti8ePH sLvCi01zgNU4sq80WEJxrY0unh9YPW1ry4YipT41FC4pdpy4k3kpYhvmAwud0Y8q DpFMjDRQUYsuH/qIz/P4/chhrFMNuMWqktxpM3/H7SmIAg3cEabMW84mc2lnDxpr ZwDeYTbrou0bTeoGs/nBT2JwGEM8lHA1cz35lfE+qAl9tcJOvsPcgx7KOrsTz7/5 hnMhNdBFNo87b3AT+Rdd0N9eGPJUHu8soPS9KKaFTCW07klKBVlcqMhXVUFvi7GF z72ZSE5y99GJsb4ORE8klHj6wR3jmXj+MgHW8a6TDqxRhKxUChfrMSZAq7Q7X91g YqTRRPnhUbrCNY282SdXbKY41CpaLOlinRx6X059RFXWHmEUmrs= =mPUJ -----END PGP SIGNATURE-----