The EU’s vulnerability-reporting service, ladies and gentlemen
Published by marco on
So I was signing up for an account with ENISA’s SRP (European Union Agency for Cybersecurity Single Reporting Platform) so that I can report actively exploited vulnerabilities, should they occur in any of my company’s products.
This is what the first page looked like.
On the next page, both tabs were selected. What are they smoking? Have they ever used other apps before?
Something went wrong. The app didn’t feel obligated to let me know what, though.
It was left up to me to guess that my session had expired—the session expires very quickly—by reloading the page and getting kicked back to the login. The problem was that the action could not be applied because there was no valid authentication and, therefore, no authorization to register anything. The app was incapable of telling me that.
Once I’d logged back in, I was able to register.
After having had the pleasure of filing a report[1]—#212 baby!—I noted that this same behavior applies to their whole web site. That is, when you fill out a long form with many text fields, you can get the error message above. Thankfully, the page does not change or reload, so you don’t lose your form data.
The inscrutable error message is the same, though, so it’s up to you to figure out that the solution is to open another tab and log in again there. When you’ve logged in again, you can come back to the form and submit it successfully, without reloading, but c’mon man, what are we doing?
[1] It turns out that we were overly cautious. ENISA quickly informed us that we really only have to report vulnerabilities in or compromises of software that we’ve produced and not in products that we include with our products but that are produced by third parties. TIL.↩