Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
14.4.2, 14.5
-
Unit
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce:
- As admin, perform a PDF export
- Examine the most recent job status file in data/jobs/status/3/export/pdf/ (in XWiki < 17.2.0/16.10.6 without the 3 in the path)
Expected result:
There isn't any sensitive data in the job status.
Actual result:
The job status contains all cookies that were sent by the user's browser including the encrypted username and password. As the encryption key is stored in the same data directory (by default it is generated in data/configuration.properties), this means that this job status contains the equivalent of the plain text password of the user who requested the PDF export.
This is a security issue as XWiki shouldn't store passwords in plain text/it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory.
Attachments
Issue Links
- is caused by
-
XWIKI-19270 Add support for performing the PDF export using a browser running in a Docker container
-
- Closed
-
- links to