Read the relevant clarification-announcement regarding XSS vulnerabilities.
As was clearly stated this morning, the weakness identified by the Greek researcher cannot undermine the electoral system. In any case, the response of the authorities was immediate and we must congratulate them for the relevant clarifying instructions that were given.
XSS-type vulnerabilities need to be addressed in cases of Web Portals (sites), in which the sensitivity of their data requires the implementation of mechanisms to maintain their confidentiality and, by extension, their users acquire usage rights to them through authentication and authorization mechanisms.
Referring to the case of the official Elections website , it should be stated categorically that none of the above is true. Specifically:
1) The website data is public and therefore does not require the activation of Confidentiality mechanisms.
2) For the above reason, no rights to use the content of the website are provided, which means that there are no requirements, nor are authentication and authorization mechanisms activated.
The only security requirement to which the data on the official Elections website falls is that of Integrity,which is in no way compromised by XSS-type vulnerabilities.
Reports about users with JavaScript knowledge and the capabilities they "possibly" acquire (in their session) over the website data do not require serious consideration on our part, as the same results can be achieved at the level of a specific user and ONLY in different ways.
Typically, we can mention the example of activating the developers tools, which are available in all known browsers and which are free to use (see use of the “InspectElement” option and the ability to format each page locally).
The above has nothing to do with the possibility of offending in any way the other users who gain access to the official Elections website.
