An Unauthenticated Bug in CIPP, Patched 43 Minutes After I Reported It
On July 14th, I found an unauthenticated path in CIPP to a Partner Center token (the control plane that sits above every Microsoft 365 tenant an MSP manages). I wrote up a casual security disclosure to the CyberDrain Security Team, and sent it off. Twelve minutes later I had a reply from Kelvin Tegelaar. Thirty-one minutes later there was a downloadable patch and every MSP running CIPP was getting the patch. I reported it and forty-three minutes later the fix was merged, versioned, and downloadable. ...