地图 / Attacker can read password from log data

Attacker can read password from log data

信息泄露 / Plaintext Storage of a Password / #519367

厂商: Midpoint (European Commission - DIGIT)
严重程度: 低危
赏金: $169
弱点: Plaintext Storage of a Password
研究员: @kingamir
披露日期: 2019-06-15
资产: https://github.com/evolveum/midpoint
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（628 字符中的一小部分）

Summary: Attacker can read plain text password from log data.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Midpoint (European Commission - DIGIT) 所有。

时间线

2019-03-31报告提交
2019-06-15公开披露

阅读 HackerOne 原文 ↗作者 @kingamir · 版权归作者与 Midpoint (European Commission - DIGIT) 所有

同类报告

Arbitrary File Reading on Uber SSL VPNUber · 2021-02-25 · $6,500 Storage of old passwords in plain text formatRecorded Future · 2022-05-12 Mail app stores cleartext password in database until OAUTH2 setup is doneNextcloud · 2023-03-08 Password of failed (2FA) login attempt is stored in logNextcloud · 2020-03-01 Local Storage Custom Node Credentials LeakMyEtherWallet · — · $250 Plain text password for 'unknown' user exist in URL when opening jira.apiok.ruok.ru · 2019-06-17

Attacker can read password from log data · 破甲 POJIA