[midPoint] Security Advisory – midPoint: Password Hints Stored in Plain Text (fixed in 4.8.14, 4.9.9, 4.10.5, 4.11)

[Martin Mareš]

Dear midPoint community, 




we would like to inform you about a security vulnerability in midPoint that has been identified and fixed in the last release. 
The full details are available in our security advisory on docs [ https://docs.evolveum.com/midpoint/security/advisories/028-plain-text-password-hints/ | https://docs.evolveum.com/midpoint/security/advisories/028-plain-text-password-hints/ ] 




Severity: 

    * Low (2.3) 

Summary 


    * The password hint ( credentials/password/hint ) was stored in the midPoint repository as a plain string and was not encrypted at rest, unlike the password value and other credential data. Anyone with access to the repository database, its backups, or to raw exports of user objects could read the hints of all users. Because users often write hints that are closely related to their passwords, a disclosed hint may significantly weaken the password. 

Impact 


    * The hint is not a secret by design: it is shown to the user during login when the password hint authentication module is configured. However, it was not protected in the same way as the other credential data, so it was exposed to anyone with direct access to the stored data. Depending on what users wrote into their hints, this may reveal their passwords or make them easy to guess. 
    * Deployments that do not use password hints are not affected. 

Mitigation 


    * Users of affected midPoint versions are advised to upgrade to the latest maintenance releases: 4.8.14, 4.9.9, or 4.10.5. 



The full details are available in our security advisory on docs [ https://docs.evolveum.com/midpoint/security/advisories/028-plain-text-password-hints/ | https://docs.evolveum.com/midpoint/security/advisories/028-plain-text-password-hints/ ] 




Best regards, 





Martin Mareš | Senior Product Manager [ https://evolveum.com/ ] 
[ mailto:martin.mares at evolveum.com | martin.mares at evolveum.com  ] | [ http://www.evolveum.com/ | www.evolveum.com ] 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260909/c93c798e/attachment.htm>