Aussie data breach #5 (or is it #6?) is @AMEBexams, which is run by unis and several state gov'ts. Its e-commerce system breach coincides with a nasty XSS software vulnerability in Adobe Commerce/Magento: helpx.adobe.com/security/produ… #auspol #infosec
To recap, @AMEBexams says its AMEB online shop database was attacked between Oct. 12-18. Says transaction/credit card data at risk. Also names, emails, phone numbers, addresses were exposed and possibly before Oct. 12 as well: Notice here: ameb.edu.au/cybersecurity
In that notice, @AMEBexams writes: "Security solutions (patches) to defend against this type of attack have since been released by Adobe and applied to the AMEB website and shop."
Adobe released a patch for CVE-2022-35698 on Oct. 11, just a day before @AMEBexams says it was attacked. The XSS flaw was bad, with a CVE ranking of 10. No auth or admin privilege required to exploit. @Ad_Nauseum74 wrote a story for the @DailySwig about it portswigger.net/daily-swig/ado…
The person who found the flaw, @Blaklis_, told the Swig that exploitation of leads to a "full shop compromise" and is easy to exploit.
Analysis: The @AMEBexams breach may be the result of not quickly applying patches. Cybercriminals who attack e-commerce systems jump on these vulnerabilities really quickly, so those who leave their systems unpatched are at great risk. #auspol #databreach #infosec
Correction: I meant to write a "CVSS" score of 10 rather than CVE. Been a long week.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
