Werk #13721: Stop returning password hashes over WebAPI

Component

Setup

Title

Stop returning password hashes over WebAPI

Date

Feb 15, 2022

Level

Trivial Change

Class

Security Fix

Compatibility

Incompatible - Manual interaction might be required

Checkmk versions & editions

2.1.0b1	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)
2.0.0p21	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

Previous to this Werk the WebAPI returned the password hashes and SessionIds when calling the get_all_users action. If the user was a automation user the password was returned in clear-text.

This data should not be returned ever. If you forgot a password you have to reset it.

To the list of all Werks