DISQUS

DISQUS Hello!  The comments on this profile are unclaimed and thus are unverified.

Do they belong to you? Claim these comments.

Anders Furseth's picture

Unregistered

Feeds

aliases

  • Anders Furseth
  • Mr. Senseless Talker

Anders Furseth

2 years ago

in Link: Spring-MVC Cross-Site Scripting Vulnerabilities on Thinking inside a bigger box
I'm glad you have trust in Sverre (he's the best), but I know for a fact it has yet to be reported. The issue here is timing. Giving the maintainer of the affected product some time to respond to the issue before disclosing the advisory is common practise among most sane people. For future reference; see http://www.wiretrip.net/rfp/policy.html for an excellent guideline for handling the interaction between a security researchers and software maintainers. Given the fact that Spring-MVC is being widely used among financial applications, I'm left to hope that the readers of your blog are merely people with good intentions. Hopefully we'll all be able to fetch Spring-MVC 2.0.3 from our local mirror very soon.

2 years ago

in Link: Spring-MVC Cross-Site Scripting Vulnerabilities on Thinking inside a bigger box
As interesting as this is, Sverre has yet to report the issues to the Spring-MVC team, making this premature disclosure unethical at best.
Returning? Login