I found a security bug on Aerohive Manager Dashboard, I sent a report to Aerohive Sec team security@aerohive.com. But 2 months ago, they have not replied to my email.

[tuatnh1]

I found a security bug on Aerohive Manager Dashboard, I sent a report to Aerohive Sec team security@aerohive.com. But 2 months ago, they have not replied to my email.

[tuatnh1]

Hi,

Can help me ask your Security team How about "that is very unlikely to be practically exploitable" ?

Because in this case, I just need to search google who is using Aerohive products on Hive Manager to be able to execute "Reflect XSS" attacks.

If they answer this vulnerability is not valid, can I publish it on the internet?

[tuatnh1]

Sound Good, Can you ask security team help me request CVE id for my report ?​

Thanks for repply.​

[samantha_lynn]

Thank you for your patience, I have sent our security teams response to you via email.

[samantha_lynn]

Thank you, I see that email and I will inquire further for you on my end. I'll let you know as soon as I have more information, please don't hesitate to check in with me periodically if you haven't heard back.