Kiosk escape (vulnerability disclosure)

[Notselwyn]

Hi there. I'm a security employee for a learning management system (LMS), and I found a kiosk escape issue/bug tested in SEB (v3.2.2) for Windows Home (10.0.19044) which allows a user in SEB to quit it without the quitting password. I'm a strong believer in coordinated vulnerability disclosure and I do not want to publish this issue in public (so people will take advantage of it). Do you have an email address where I can report it?

[dbuechel]

Thanks for reaching out to us before publishing your findings. Please feel free to contact us under info at safeexambrowser dot org.

[Notselwyn]

I can't find any contact information besides the Github repo. Can you please drop a hint where I can find it? ;-)

[danschlet]

@dbuechel meant the e-mail address info at safeexambrowser dot org. at=@ dot=.

[Notselwyn]

Alright. I'm sending the email now

[dbuechel]

@Notselwyn We were able to fix the vulnerability, please feel free to test it in the latest beta version.

[dbuechel]

A fix for the issue is now available in version 3.4.0.

[Notselwyn]

Update: the issue got assigned CVE-2022-36220. It took MITRE relatively long, but it's here👍

[Notselwyn]

I've asked MITRE to publish it so that it won't say reserved anymore and give basic descriptions with a reference. Should be updated soon

[Notselwyn]

CC @dbuechel (notif)