Crowd User Directory application password stored in plain text

XMLWordPrintable

    • 6.02
    • 2
    • Severity 3 - Minor
    • 1

      Table: cwd_directory_attribute
      Column: attribute_value

      How to Verify (in my environment):
      Connect to JIRA database using psql and run query:

      select attribute_value from cwd_directory_attribute where attribute_name = 'application.password'

      Note how the returned value is the plain text value of the password you entered when defining the user directory in JIRA

        1. screenshot-of-blurred-password-from-keepassx.png
          screenshot-of-blurred-password-from-keepassx.png
          39 kB
        2. jira-stores-user-directory-app-passwords-in-plaintext-as-well.png
          jira-stores-user-directory-app-passwords-in-plaintext-as-well.png
          48 kB

              Assignee:
              Unassigned
              Reporter:
              William Crighton [CCC]
              Votes:
              1 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: