-
Type:
Enhancement
-
Status:
Closed
-
Priority:
Medium
-
Resolution:
Done
-
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Production Complete
- Closed
Praetorian discovered this vulnerability while examining the application’s user account management features. This feature does not require a user's current password to update their email address. This is shown in the figure below.
Ideally on Partner/Broker or company admin page, we should not able to update any field without asking old password. This password should not be sent to client side for verification.
- relates to
-
WT-1981
Localization for password authentication
-
-
Closed
No work has yet been logged on this issue.
{"report":{"apdex":1,"isInitial":true,"journeyId":"96003de2-a00c-4165-98f1-2a409366b69c","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":633.1999998092651,"redirectCount":0,"resourceLoadedEnd":732.1999998092651,"resourceLoadedStart":100.19999980926514,"resourceTiming":[{"duration":156.80000019073486,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":100.19999980926514,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":100.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":257,"responseStart":0,"secureConnectionStart":0},{"duration":156.5,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":100.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":100.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":257,"responseStart":0,"secureConnectionStart":0},{"duration":156.5,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":100.59999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":100.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":257.09999990463257,"responseStart":0,"secureConnectionStart":0},{"duration":156.59999990463257,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":100.59999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":100.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":257.19999980926514,"responseStart":0,"secureConnectionStart":0},{"duration":156.5,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":100.7999997138977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":100.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":257.2999997138977,"responseStart":0,"secureConnectionStart":0},{"duration":176.09999990463257,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":100.7999997138977,"connectEnd":100.7999997138977,"connectStart":100.7999997138977,"domainLookupEnd":100.7999997138977,"domainLookupStart":100.7999997138977,"fetchStart":100.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":100.7999997138977,"responseEnd":276.8999996185303,"responseStart":276.8999996185303,"secureConnectionStart":100.7999997138977},{"duration":295.69999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":101,"connectEnd":101,"connectStart":101,"domainLookupEnd":101,"domainLookupStart":101,"fetchStart":101,"redirectEnd":0,"redirectStart":0,"requestStart":101,"responseEnd":396.69999980926514,"responseStart":396.69999980926514,"secureConnectionStart":101},{"duration":298.2999997138977,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":101.09999990463257,"connectEnd":101.09999990463257,"connectStart":101.09999990463257,"domainLookupEnd":101.09999990463257,"domainLookupStart":101.09999990463257,"fetchStart":101.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":101.09999990463257,"responseEnd":399.3999996185303,"responseStart":399.3999996185303,"secureConnectionStart":101.09999990463257},{"duration":298.59999990463257,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":101.19999980926514,"connectEnd":101.19999980926514,"connectStart":101.19999980926514,"domainLookupEnd":101.19999980926514,"domainLookupStart":101.19999980926514,"fetchStart":101.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":101.19999980926514,"responseEnd":399.7999997138977,"responseStart":399.7999997138977,"secureConnectionStart":101.19999980926514},{"duration":298.7000002861023,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":101.39999961853027,"connectEnd":101.39999961853027,"connectStart":101.39999961853027,"domainLookupEnd":101.39999961853027,"domainLookupStart":101.39999961853027,"fetchStart":101.39999961853027,"redirectEnd":0,"redirectStart":0,"requestStart":101.39999961853027,"responseEnd":400.09999990463257,"responseStart":400.09999990463257,"secureConnectionStart":101.39999961853027},{"duration":298.8999996185303,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":101.5,"connectEnd":101.5,"connectStart":101.5,"domainLookupEnd":101.5,"domainLookupStart":101.5,"fetchStart":101.5,"redirectEnd":0,"redirectStart":0,"requestStart":101.5,"responseEnd":400.3999996185303,"responseStart":400.2999997138977,"secureConnectionStart":101.5},{"duration":299.09999990463257,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":101.59999990463257,"connectEnd":101.59999990463257,"connectStart":101.59999990463257,"domainLookupEnd":101.59999990463257,"domainLookupStart":101.59999990463257,"fetchStart":101.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":101.59999990463257,"responseEnd":400.69999980926514,"responseStart":400.69999980926514,"secureConnectionStart":101.59999990463257},{"duration":299.40000009536743,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":101.69999980926514,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":101.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":401.09999990463257,"responseStart":0,"secureConnectionStart":0},{"duration":299.6000003814697,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":101.89999961853027,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":101.89999961853027,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":401.5,"responseStart":0,"secureConnectionStart":0},{"duration":299.2000002861023,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/ea6f30d2bfdc99578bb23f4a5bac3ecd/shortcuts.js?context=issuenavigation&context=issueaction","startTime":101.89999961853027,"connectEnd":101.89999961853027,"connectStart":101.89999961853027,"domainLookupEnd":101.89999961853027,"domainLookupStart":101.89999961853027,"fetchStart":101.89999961853027,"redirectEnd":0,"redirectStart":0,"requestStart":101.89999961853027,"responseEnd":401.09999990463257,"responseStart":401,"secureConnectionStart":101.89999961853027},{"duration":299.5,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":102,"connectEnd":102,"connectStart":102,"domainLookupEnd":102,"domainLookupStart":102,"fetchStart":102,"redirectEnd":0,"redirectStart":0,"requestStart":102,"responseEnd":401.5,"responseStart":401.5,"secureConnectionStart":102},{"duration":56.59999990463257,"initiatorType":"xmlhttprequest","name":"https://jira.workterra.net/rest/webResources/1.0/resources","startTime":426.7999997138977,"connectEnd":426.7999997138977,"connectStart":426.7999997138977,"domainLookupEnd":426.7999997138977,"domainLookupStart":426.7999997138977,"fetchStart":426.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":426.7999997138977,"responseEnd":483.3999996185303,"responseStart":483.2999997138977,"secureConnectionStart":426.7999997138977}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":22,"responseStart":95,"responseEnd":95,"domLoading":98,"domInteractive":776,"domContentLoadedEventStart":776,"domContentLoadedEventEnd":816,"domComplete":974,"loadEventStart":974,"loadEventEnd":977,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"1fbb8bad3b728e","effectiveType":"4g","downlink":9.5,"rtt":0,"serverDuration":46,"dbReadsTimeInMs":6,"dbConnsTimeInMs":8,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}