Loading...

XML

Word

Printable

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 2.6.5, 2.3.10, 2.4.11, 2.5.6
Affects Version/s: 2.6.4
Component/s: OpenID
Labels:
- cvss-medium
- security

Bug Fix Policy:
View Atlassian Server bug fix policy

Similar to ~~CWD-3465~~, it seems that not enforce profile ownership for viewing. That is, a non-admin user called Mallory can view Alice's profile information if Mallory obtains Alice's profileId number. For example, https://openid.atlassian.com/secure/profile/editprofiles.action?profileID=15240744 shows you my profile details.

relates to

CWD-3465 Crowd OpenID server does not enforce profile ownership for edits

Closed

Assignee:: Unassigned

Reporter:: David Black

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Created:: 19/Jul/2013 5:18 AM

Updated:: 15/Aug/2019 7:05 AM

Resolved:: 29/Jul/2013 4:37 AM