[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiMmE3MDQ2ZTBlZTcyNDA4YTgwZTNmOTViOWRiY2E1YTMiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiMmE3MDQ2ZTBlZTcyNDA4YTgwZTNmOTViOWRiY2E1YTMiLCJwIjoiaiJ9 )

It's worth noting that this might be considered as excessive - we might want to allow Users read access to that directory but I’d sooner add that on demand particularly since there might be stuff down there that we don't want people to see - particularly in etc

I suspect that this might cause a world of grief to IIS users but I am not sure what to do about it except document it (which I’ll do once we know what to do about releasing this )

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiMmE3MDQ2ZTBlZTcyNDA4YTgwZTNmOTViOWRiY2E1YTMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiMmE3MDQ2ZTBlZTcyNDA4YTgwZTNmOTViOWRiY2E1YTMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:9b34d7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/547c9e80/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-28e6b263-5b7f-4e16-8156-e5f13e61be6f
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/547c9e80/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-6e165b49-b75b-45e1-9c59-9770e55988eb
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/547c9e80/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-b8174f98-f5c0-47d2-a1b0-74a8cc02288a
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/547c9e80/attachment-0005.png>