Hacker News Reader

Comment by United857 | Hacker News Reader

Now that the cat's out of the bag, might as well link to the tweet: https://twitter.com/fluepke/status/1549892089181257729

View on HN

For reference, the tweets are as follows:

Discovered by a fried of mine:

CVE-2022-26138: A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group

The password is disabled1system1user6708

Proof: https://packages.atlassian.com/maven-atlassian-external/com/...

Also saved to the @internetarchive just to make sure, it stays online: https://web.archive.org/web/20220720225515/https://d34y9yt11...

A pet peeve of mine is when news articles cite public sources like social media but don't bother to link to them. I can understand for NSFW content but that should be the exception not the rule!

Why would you want them to give publicity to a description on how to exploit something? At least when you don't publish the "hack" you can let people know to take action without trivializing the exploit. Yes, I know it's still trivial to find it by searching Twitter.

It's a matter of responsible disclosure. Increased terror causes increased publicity, causing more systems to be fixed, and pushes more people to take urgent action against the vulnerabilities. Your PHB cannot say "hackers would need a password, don't worry".

What's PHB?

The Pointy Haired Boss is the main "villain" in the Dilbert comic strip by Scott Adams.

Yeah, this was the initial discovery/disclosure tweet, as far as I know. Notice it was posted two days ago, same as the announcement from Atlassian.

As least the password isn’t “12345.”

Hey, that's the combination on my luggage!

Reply on news.ycombinator.com