Crowd User Directory application password stored in plain text

XMLWordPrintable

    • 6.02
    • 2
    • Severity 3 - Minor
    • 1

      Table: cwd_directory_attribute
      Column: attribute_value

      How to Verify (in my environment):
      Connect to JIRA database using psql and run query:

      select attribute_value from cwd_directory_attribute where attribute_name = 'application.password'

      Note how the returned value is the plain text value of the password you entered when defining the user directory in JIRA

        1. jira-stores-user-directory-app-passwords-in-plaintext-as-well.png
          jira-stores-user-directory-app-passwords-in-plaintext-as-well.png
          48 kB
        2. screenshot-of-blurred-password-from-keepassx.png
          screenshot-of-blurred-password-from-keepassx.png
          39 kB

            Assignee:
            Unassigned
            Reporter:
            William Crighton [CCC]
            Votes:
            1 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: