Werk #6709: Fixed possible information disclosure to apache log when editing users
Komponente | Setup |
Titel | Fixed possible information disclosure to apache log when editing users |
Datum | 21.09.2018 |
Checkmk Edition | Checkmk Raw (CRE) |
Checkmk-Version | 1.4.0p37 1.5.0p5 1.6.0b1 |
Level | Kleine Änderung |
Klasse | Sicherheitsfix |
Kompatibilität | Kompatibel - benötigt kein manuelles Eingreifen |
An administrator has the ability to create new users. The credentials of a newly created user were visible within the HTML of the resulting web page as GET parameter of various hyperlinks. If one of these links was clicked, the credentials were stored in the administrator’s browser history and in the access logs of the server.