Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-19869

Password reset stores passwords in plaintext

    XMLWordPrintable

Details

    • High
    • Easy

    Description

      Tested on 14.4.1 but according to github the current state is still affected.

      When the the reset password form is used the new password is stored in plaintext.

      xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManager.java - Line 317:

      userXObject.setStringValue("password", newPassword);

      After fixing this a migration will be needed to convert passwords that are currently stored in plaintext into hashes.

      Furthermore, this indicates that the authentication check works against a stored plaintext password. This should not be possible.

      Attachments

        Issue Links

          causes

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-20067 Misleading logs suggesting that the security mails about clear passwords were not sent

          • Major - Major loss of function.
          • Closed
          is related to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-19945 Reset password and forgot username features are not working for subwiki users

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-11205 If view rights are not allowed for guest users then ResetPassword doesn't work

          • Major - Major loss of function.
          • Closed

          Activity

            People

              surli Simon Urli
              yoksner Yana Oksner
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: