My friend noticed this: If you login to your tumblr account then manually go to /admin it takes you to the systemwide tumblr admin... wow.
Tumblr security hole (the gaping kind)
1–10 of 85 posts
Re: Tumblr security hole (the gaping kind)
#2Whoa.
Re: Tumblr security hole (the gaping kind)
#3If that's true, the lead developer should be fired on the spot. They use that "good" old "security by obscurity". I thought this technique was dead long ago....
Re: Tumblr security hole (the gaping kind)
#4Probably better to let Tumblr know first, then us.
Edit: just confirmed that it works.
Basically let's you search users by id or email then give you ability to change their email/reset password.
Re: Tumblr security hole (the gaping kind)
#5Screenshot or it didn't happen ;-)
Re: Tumblr security hole (the gaping kind)
#6If that's true, the lead developer should be fired on the spot. They use that "good" old "security by obscurity". I thought this technique was dead long ago....
/admin is obscure? :/
Re: Tumblr security hole (the gaping kind)
#7That is absolutely unbelievable.
Re: Tumblr security hole (the gaping kind)
#8Did you or your friend happen to report this to them before posting it here?
Re: Tumblr security hole (the gaping kind)
#9If that's true, the lead developer should be fired on the spot. They use that "good" old "security by obscurity". I thought this technique was dead long ago....
a little harsh maybe....developers make mistakes...probably just forgot about it while trying to get the initial release out the door.... its not like tumblr is a bank or the DoD
Re: Tumblr security hole (the gaping kind)
#10Did you or your friend happen to report this to them before posting it here?
yeah he said he told them. I would have more sympathy if it was an obscure hole, but something this big is just disrespectful to their users.