-
Type:
Enhancement
-
Status:
Closed
-
Priority:
Medium
-
Resolution:
Done
-
Affects Version/s:
None
-
-
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Production Complete
-
Pretorian reported an issue that password is returning is server response is potential threat to system.
The user’s password is returned in the response from the server when an administrator creates an account for a new employee
By sending a user password as a response during account registration, WORKTERRA increases the possibility of the password being sniffed on the wire, or compromised via local workstation access.
When registering a new employee, the employee's default password was displayed to the registrar.
Ideally we should not display password to administrator.
We need to find out all possible locations in System where we are sending password to client side.
Possible solution for this is to remove add employee popup which displays credentials.
Configuration flag should decide whether we need to display newly added employee password in alert or not.
{"report":{"apdex":0.5,"isInitial":true,"journeyId":"69360099-b54a-457f-822c-51664e19166e","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":1253.7999999970198,"redirectCount":0,"resourceLoadedEnd":1449.0999999940395,"resourceLoadedStart":298.09999999403954,"resourceTiming":[{"duration":211.1000000089407,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":298.09999999403954,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":298.09999999403954,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":509.20000000298023,"responseStart":0,"secureConnectionStart":0},{"duration":305.70000000298023,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":298.29999999701977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":298.29999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":604,"responseStart":0,"secureConnectionStart":0},{"duration":305.6000000089407,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":298.3999999910593,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":298.3999999910593,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":604,"responseStart":0,"secureConnectionStart":0},{"duration":305.6000000089407,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":298.3999999910593,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":298.3999999910593,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":604,"responseStart":0,"secureConnectionStart":0},{"duration":315.70000000298023,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":298.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":298.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":614.2000000029802,"responseStart":0,"secureConnectionStart":0},{"duration":323.8999999910593,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":298.70000000298023,"connectEnd":298.70000000298023,"connectStart":298.70000000298023,"domainLookupEnd":298.70000000298023,"domainLookupStart":298.70000000298023,"fetchStart":298.70000000298023,"redirectEnd":0,"redirectStart":0,"requestStart":298.70000000298023,"responseEnd":622.5999999940395,"responseStart":622.5999999940395,"secureConnectionStart":298.70000000298023},{"duration":356.20000000298023,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":298.79999999701977,"connectEnd":298.79999999701977,"connectStart":298.79999999701977,"domainLookupEnd":298.79999999701977,"domainLookupStart":298.79999999701977,"fetchStart":298.79999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":298.79999999701977,"responseEnd":655,"responseStart":655,"secureConnectionStart":298.79999999701977},{"duration":358.20000000298023,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":299.29999999701977,"connectEnd":299.29999999701977,"connectStart":299.29999999701977,"domainLookupEnd":299.29999999701977,"domainLookupStart":299.29999999701977,"fetchStart":299.29999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":299.29999999701977,"responseEnd":657.5,"responseStart":657.5,"secureConnectionStart":299.29999999701977},{"duration":358.5,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":299.3999999910593,"connectEnd":299.3999999910593,"connectStart":299.3999999910593,"domainLookupEnd":299.3999999910593,"domainLookupStart":299.3999999910593,"fetchStart":299.3999999910593,"redirectEnd":0,"redirectStart":0,"requestStart":299.3999999910593,"responseEnd":657.8999999910593,"responseStart":657.8999999910593,"secureConnectionStart":299.3999999910593},{"duration":358.79999999701977,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":299.59999999403954,"connectEnd":299.59999999403954,"connectStart":299.59999999403954,"domainLookupEnd":299.59999999403954,"domainLookupStart":299.59999999403954,"fetchStart":299.59999999403954,"redirectEnd":0,"redirectStart":0,"requestStart":299.59999999403954,"responseEnd":658.3999999910593,"responseStart":658.3999999910593,"secureConnectionStart":299.59999999403954},{"duration":358.8999999910593,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":299.70000000298023,"connectEnd":299.70000000298023,"connectStart":299.70000000298023,"domainLookupEnd":299.70000000298023,"domainLookupStart":299.70000000298023,"fetchStart":299.70000000298023,"redirectEnd":0,"redirectStart":0,"requestStart":299.70000000298023,"responseEnd":658.5999999940395,"responseStart":658.5999999940395,"secureConnectionStart":299.70000000298023},{"duration":365.70000000298023,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":299.79999999701977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":299.79999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":665.5,"responseStart":0,"secureConnectionStart":0},{"duration":359.09999999403954,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":299.79999999701977,"connectEnd":299.79999999701977,"connectStart":299.79999999701977,"domainLookupEnd":299.79999999701977,"domainLookupStart":299.79999999701977,"fetchStart":299.79999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":299.79999999701977,"responseEnd":658.8999999910593,"responseStart":658.8999999910593,"secureConnectionStart":299.79999999701977},{"duration":366,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":300,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":300,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":666,"responseStart":0,"secureConnectionStart":0},{"duration":359.29999999701977,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/ea6f30d2bfdc99578bb23f4a5bac3ecd/shortcuts.js?context=issuenavigation&context=issueaction","startTime":300,"connectEnd":300,"connectStart":300,"domainLookupEnd":300,"domainLookupStart":300,"fetchStart":300,"redirectEnd":0,"redirectStart":0,"requestStart":300,"responseEnd":659.2999999970198,"responseStart":659.2999999970198,"secureConnectionStart":300},{"duration":359.6000000089407,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":300.09999999403954,"connectEnd":300.09999999403954,"connectStart":300.09999999403954,"domainLookupEnd":300.09999999403954,"domainLookupStart":300.09999999403954,"fetchStart":300.09999999403954,"redirectEnd":0,"redirectStart":0,"requestStart":300.09999999403954,"responseEnd":659.7000000029802,"responseStart":659.7000000029802,"secureConnectionStart":300.09999999403954},{"duration":943.5999999940395,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":301,"connectEnd":301,"connectStart":301,"domainLookupEnd":301,"domainLookupStart":301,"fetchStart":301,"redirectEnd":0,"redirectStart":0,"requestStart":301,"responseEnd":1244.5999999940395,"responseStart":1244.5999999940395,"secureConnectionStart":301}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":179,"responseStart":289,"responseEnd":290,"domLoading":295,"domInteractive":1660,"domContentLoadedEventStart":1660,"domContentLoadedEventEnd":1744,"domComplete":2187,"loadEventStart":2187,"loadEventEnd":2190,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"bce0d17362e305","effectiveType":"4g","downlink":9.4,"rtt":0,"serverDuration":78,"dbReadsTimeInMs":20,"dbConnsTimeInMs":22,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Dhanashree Sherkar (Inactive)
added a comment - Verified on stage.
Company name:- 1.OCSD for hspl
2.City of Durham For HSPL
Log in:-1.Partner
2.Admin
On security page system displayed check box for 'To Display Password on Add Employee.'
Admin/partner can check or uncheck check box for password.
refer attached screenshot.
On Add employee page system not displayed employee credential for uncheck.
Employee credential pop up displayed when check box is selected.
Refer attached screenshot.
above scenarios tested for benadmin & Recruit module.
For SEO testing is in progress.
Kunal Kedari (Inactive)
added a comment - We have verified the enhancement on Production for BenAdmin & Recruit module, working as expected.
Due to other priority tasks, keeping this in Backlog.