CBS Last.fm fixes admin password leakage via Symfony profiler

guest · Nov 27, 2020

CBS Last.fm fixes admin password leakage via Symfony profiler
November 27, 2020
https://www.bleepingcomputer.com/ne...-admin-password-leakage-via-symfony-profiler/

This week, British music streaming service, Last.fm has fixed a credential leakage issue that revealed admin username and password.

The leak had occurred due to a misconfigured PHP Symfony app running in "debug" mode and exposing profiler logs.
Diachenko said, the misconfigured Symfony app found by Kaul had been exposing "PHPinfo page and profiler logs with credentials."

If misused, these leaked credentials would have allowed attackers to query each and every Last.fm user for critical info.

"From what we understood it was part of the admin dashboard, allowing [users] to view and edit Last.fm users' account info and details," Diachenko told BleepingComputer.
Click to expand...

Log in or Sign up

CBS Last.fm fixes admin password leakage via Symfony profiler

guest Guest

Log in or Sign up

CBS Last.fm fixes admin password leakage via Symfony profiler

guest Guest

Useful Searches