I work over the phone tech support. A few weeks ago I found an XSS vulnerability that would affect essentially private comments on a users home page in my company’s software, while investigating this and writing up a report for my supervisor (who is basically an hr person with no relevant tech experience) I also found a flaw in the login procedure that would allow anyone someone to bypass the password field when signing in.
With these issues together I immediately informed my supervisor and stressed that this could impact a large number of our customers and might make our software no longer compliant with government regulations it is required to follow.
It’s now been almost two months and the issue still exists, and I have yet to have a serious conversation with anyone in a position to start the process or resolving this issue.
The impact would by and large affect primarily individuals who are older and not tech-savvy. Additionally, this software is used for work and usually, individuals using it do not have a suitable alternative to my companies software.
If this were a company I did not work for I would already have gone public with enough information to allow people who have alternatives to use them. I’m wondering if there is a point I should go public, what can I do to get in communication with someone at my company that can implement changes. At this point, I’ve made enough of a stink that if this were to go public it would be traced to me.
Any help or advice would be appreciated.