[HN Gopher] Possible Azure RCE
       ___________________________________________________________________
        
       Possible Azure RCE
        
       Author : sambazi
       Score  : 24 points
       Date   : 2024-06-07 11:42 UTC (11 hours ago)
        
 (HTM) web link (www.zerodayinitiative.com)
 (TXT) w3m dump (www.zerodayinitiative.com)
        
       | croes wrote:
       | >DISCLOSURE TIMELINE
       | 
       | >2023-10-03 - Vulnerability reported to vendor
       | 
       | >2024-06-06 - Coordinated public release of advisory
        
         | VoidWhisperer wrote:
         | For something given a cvss of 10, that is a ridiculous amount
         | of time.. although hopefully they fixed it within a reasonable
         | amount of time and just took forever to disclose it
        
           | mckirk wrote:
           | I don't necessarily disagree with the rating of 10 here (I
           | know anything about the actual impact of this vulnerability),
           | but please note that CVSS really isn't a perfect system, and
           | it is quite easy to reach ridiculously high CVSS scores with
           | even minor vulnerabilities, if you are 'maybe a bit too
           | literal' in its interpretation.
           | 
           | The official CVSS3.1 example score for a stored XSS is 9.0.
        
         | bastawhiz wrote:
         | I'm curious what communication happened in that time. I'm not
         | inclined to give Microsoft the benefit of the doubt but
         | "vulnerability reported" doesn't necessarily mean "we sent full
         | details in a clearly documented way to the right place where it
         | would get in front of a human".
        
       ___________________________________________________________________
       (page generated 2024-06-07 23:02 UTC)