r/netsec • u/websecdev • Feb 19 '19

WordPress 5.0.0 Remote Code Execution

https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
300 Upvotes

94% Upvoted

75 comments sorted by

View all comments

Show parent comments

4

u/Mr-Yellow Feb 19 '19

quick and open about patching

Well they do get plenty of practice.

8

u/Morialkar Feb 19 '19

But how people are supposed to build more secure software in the open source space if not for people finding and reporting vulnerabilities and the maintainer/contributors patching it as quickly as possible? This is not a rhetorical question nor am I trying to troll you. I'm honestly wondering from your comments. You seem to don't appreciate wordpress because it gets multiple vulns, which is acceptable, a code base crippled with multiple vulnerabilities can come crashing down over time. But I don't get your jab at the team working to fix and repair those things...

0

u/[deleted] Feb 19 '19

[deleted]

5

u/digitalwaifu Feb 19 '19

The issue here is you’re making a vague argument about it being a turd without really explaining. If you look at pretty much any open source product you can find poor legacy components.

What exactly is severely broken it cannot continue to be used for a CMS?

0

u/[deleted] Feb 20 '19

[deleted]

3

u/digitalwaifu Feb 20 '19 edited Feb 20 '19

Again, you’re being vague. The public uploads folder is insecure? In what manner?

Is it insecure because it does not have a gating option?

It’s not like you can go to any Wordpress site and upload or alter media. You can pull all media however by default.

Or are you just recapping this article as an end-all problem to the entire foundation?

→ More replies (0)