MubelotixDec 9

Umami is vulnerable - upgrade immediately

https://jlai.lu/post/29883346

Show threadrayboy
Wow I’m glad I happened to see this here. Thank you for the post. I was just thinking about putting all my services behind a VPN too, I think I’m going to go ahead and put that at the top of the list…
Dec 9 at 2:15pmWeb
Show threadGottaHaveFaithDec 9
I don't think a vpn would help here
Show threadGraveyardOrbitDec 9
Exploiting this vulnerability requires access to the service which wouldn’t be possible if it was behind a vpn
Show threadGottaHaveFaithDec 9
Yes I re-read the cve, I thought it was an issue with an npm package with a cryptominer
Show threadEncrypt-KeeperDec 9
Yeah but Umami is an analytics engine power by client side tracking. If it was behind a VPN it would be useless.
Show threadfrongtDec 9
Unless it was the software package itself that was compromised.
Show threadEncrypt-KeeperDec 10
It was not