Vulnerability or Not? Pen Tester Quarrels With Software Maker

guest · Jul 19, 2018

Vulnerability or Not? Pen Tester Quarrels With Software Maker
Researcher Publishes PoC; Vendor Says it's Not a Vulnerability
July 18, 2018
https://www.securityweek.com/vulnerability-or-not-pen-tester-quarrels-software-maker

A SpiderLabs security researcher has published details of what he considers to be a vulnerability in the RLM web application provided by Reprise Software. Reprise CEO Matt Christiano has told SecurityWeek, it is not a vulnerability.

During a penetration engagement, Pruteanu writes, "I was able to identify a critical vulnerability which allowed me to execute code on the server, eventually leading to full domain compromise. Regrettably, despite my best efforts, the vendor has refused to issue patches as they do not believe these findings to be vulnerabilities."

Christiano responded, "The issue described in the [SpiderLabs] article is certainly not a vulnerability, it is misuse of the product."

"The biggest problem we run into during the disclosure process," comments Pruteanu "is getting the disclosure in front of the correct audience. Even though these vendors are basically getting a free audit that helps them secure their products for their customers, we are often met with hostility [...]"
Click to expand...

Log in or Sign up

Vulnerability or Not? Pen Tester Quarrels With Software Maker

guest Guest

Log in or Sign up

Vulnerability or Not? Pen Tester Quarrels With Software Maker

guest Guest

Useful Searches