Thursday , April 24 2025
owasp

OWASP discloses data breach caused by wiki misconfiguration

The nonprofit OWASP warned its members about a possible data breach that could have affected anyone who was a member of the organization from 2006 to 2014.

The foundation released a statement on Friday, saying they found old resumes on an old Wiki server in late February.

SonicWall patched SSLVPN Vuln Allowing Firewall Crashing

SonicWall has revealed a vulnerability in its SonicOS SSLVPN Virtual Office interface that could let remote attackers crash firewall appliances....
Read More
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing

GitLab Releases Security Update For Multiple Vulns

GitLab has announced a security advisory urging users to upgrade their self-managed installations right away. Versions 17.11.1, 17.10.5, and 17.9.7...
Read More
GitLab Releases Security Update For Multiple Vulns

ISPAB president “whatsapp” got hacked via phishing link

Imdadul Haque, the president of Internet Service Provider of Bangladesh (ISPAB) said, I automatically got back my WhatsApp account. What...
Read More
ISPAB president “whatsapp” got hacked via phishing link

Zyxel released patches 2 vulns in its USG FLEX H series firewalls

Zyxel Networks has issued critical security patches for two high-severity vulnerabilities in its USG FLEX H series firewalls. These flaws...
Read More
Zyxel released patches 2 vulns in its USG FLEX H series firewalls

South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked

South Korea's largest mobile operator, SK Telecom, is warning that a malware infection allowed threat actors to access sensitive USIM-related...
Read More
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked

ChatGPT Develops Exploit for CVEs Before Public PoCs Share

Security researcher Matt Keeley showed that artificial intelligence can now develop working exploits for critical vulnerabilities before public proof-of-concept (PoC)...
Read More
ChatGPT Develops Exploit for CVEs Before Public PoCs Share

TP-Link Router Vulns Allow to Execute Malicious SQL Commands

Several vulnerabilities have been found in TP-Link routers, exposing users to serious security risks from SQL injection flaws in their...
Read More
TP-Link Router Vulns Allow to Execute Malicious SQL Commands

SSL.com’s domain validation system’s bug found: Hacker exploited

SSL.com has revealed a major security flaw in its domain validation system, which could enable attackers to acquire fake SSL...
Read More
SSL.com’s domain validation system’s bug found: Hacker exploited

Amazon Follows Microsoft’s Lead, Halts Some Data Center Deals

Amazon has paused some data center lease negotiations for its cloud division, particularly in international markets, according to Wells Fargo...
Read More
Amazon Follows Microsoft’s Lead, Halts Some Data Center Deals

Hackers Exploit Zoom’s Remote Control Feature for System Access

ELUSIVE COMET is a threat actor conducting a sophisticated attack campaign that uses Zoom's remote control feature to access victims'...
Read More
Hackers Exploit Zoom’s Remote Control Feature for System Access

The organization calls itself the “world’s largest non-profit organization concerned with software security” and has more than 250 chapters around the world with tens of thousands of members.

The OWASP Foundation’s Executive Director, Andrew van der Stock, said around 1,000 resumes were on the server, but he wasn’t sure if there were any duplicates.

Van der Stock believes that only OWASP staff have accessed the server, and it was archived by the Wayback Machine in 2023 but not re-indexed.

“Unfortunately, the log retention policy on the small VPS [Virtual Private Server] it was hosted upon only means we have limited logs, so we don’t think it was widely accessed, but as the misconfiguration dates back to at least 2019 when the VPS was first stood up, we simply don’t know, and as the file system is small, any old data would have been long overwritten even if forensics was possible,” he said.

Van der Stock explained that it was difficult to find the directory with the resumes because it was not indexed separately from the organization’s Wiki installation.

“So in all likelihood, considering that we only just got our first support tickets about it means that it wasn’t widely accessed prior to February 2024,” he said.

OWASP has advised that anyone who was a member between 2006 and 2014 and had submitted a resume should assume their information was compromised.
The organization collected the data during a membership process where applicants had to show connections to the OWASP community. They no longer ask for resumes and use cloud-based security practices to protect member information.

OWASP has addressed the issue by disabling directory browsing, reviewing the web server and MediaWiki configuration for other security problems, completely removing the resumes from the wiki site, and clearing the CloudFlare cache to prevent further access.

“Lastly, we have requested that the information be removed from the Web Archive,” the organization said.

OWASP had to make this issue public because many people who could be affected are no longer members and it’s hard to contact them.

According to OWASP, affected individuals don’t need to do anything because the information has been removed from the internet. However, they should be cautious of possible scam attempts if any of the resume information is still valid.

“We recognize the significance of this breach, especially considering the OWASP Foundation’s emphasis on cybersecurity. We apologize to those affected by the breach and are committed to ensuring that this does not happen again,” the notice said.

“We are reviewing our data retention policies and will be implementing additional security measures to prevent future breaches.”

 

Check Also

Australian Cyber Security Centre Alert for Fortinet Products

The Australian Cyber Security Centre (ACSC) has alerted technical users in both private and public …

Leave a Reply

Your email address will not be published. Required fields are marked *