Apache Struts - Critical Security Flaw
-
@coliver said in Apache Struts - Critical Security Flaw:
@dustinb3403 So where does it go from incompetence to malevolent incompetence?
It's already at the point of being intentional. Everyone in the chain of command from the CEO to the head of the IT department to the System Administrator who didn't patch the system should be brought up on charges and burned at the stake.
-
@coliver said in Apache Struts - Critical Security Flaw:
@dustinb3403 said in Apache Struts - Critical Security Flaw:
Oh wonderful. . .
The fact that they didn't patch it makes it more concerning. It's not necessarily the architecture at that point. If they had updated their infrastructure and implemented a patch this would have been a non-issue.
Is that true? The exploit has been there in Struts for a while but only recently announced. The breach was a while ago. I'm not sure that Struts had been patched at that point.
-
@coliver said in Apache Struts - Critical Security Flaw:
@dustinb3403 So where does it go from incompetence to malevolent incompetence?
When you accept the job knowing you are incompetent.
-
@scottalanmiller said in Apache Struts - Critical Security Flaw:
@coliver said in Apache Struts - Critical Security Flaw:
@dustinb3403 said in Apache Struts - Critical Security Flaw:
Oh wonderful. . .
The fact that they didn't patch it makes it more concerning. It's not necessarily the architecture at that point. If they had updated their infrastructure and implemented a patch this would have been a non-issue.
Is that true? The exploit has been there in Struts for a while but only recently announced. The breach was a while ago. I'm not sure that Struts had been patched at that point.
It was patched two months prior to when the web application was exploited.
-
@coliver said in Apache Struts - Critical Security Flaw:
@scottalanmiller said in Apache Struts - Critical Security Flaw:
@coliver said in Apache Struts - Critical Security Flaw:
@dustinb3403 said in Apache Struts - Critical Security Flaw:
Oh wonderful. . .
The fact that they didn't patch it makes it more concerning. It's not necessarily the architecture at that point. If they had updated their infrastructure and implemented a patch this would have been a non-issue.
Is that true? The exploit has been there in Struts for a while but only recently announced. The breach was a while ago. I'm not sure that Struts had been patched at that point.
It was patched two months prior to when the web application was exploited.
No Equifax failed to patch until 2 months after they were breached.
-
Equifax was breached in May. Patch for Struts was in March. They announced the breach last week.
-
@momurda said in Apache Struts - Critical Security Flaw:
Equifax was breached in May. Patch for Struts was in March. They announced the breach last week.
Oh, well zero excuses then.
-
here is the Apache explanation
-
Was the Eqifax breech because of the march strus flaw or a more recent one?
Just making sure the actual facts are known.
-
@jaredbusch said in Apache Struts - Critical Security Flaw:
Was the Eqifax breech because of the march strus flaw or a more recent one?
Just making sure the actual facts are known.
The one from March.
