<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Date: 30 July 2019<br>
Severity: Medium (CVSS 4.3)<br>
Affected versions: all released midPoint versions<br>
Fixed in versions: 4.0 (unreleased), 3.9.1 (unreleased)<br>
<br>
Description<br>
<br>
Authorizations not applied properly to the results of "preview
changes" functionality.<br>
<br>
Severity and Impact<br>
<br>
In the "preview changes" screen user can see information that that
user is not authorized to see. Authorizations are not properly
applied to preview deltas. Therefore if user's actions results in a
computed value such value is displayed in the "preview changes" even
if user is not authorized to see it.<br>
<br>
Mitigation<br>
<br>
Users of affected MidPoint versions are advised to upgrade their
deployments to the latest builds from the support branches. Users of
midPoint 3.8 and earlier are advised to upgrade to midPoint 3.9.<br>
<br>
As this is a medium severity issue, it is not forcing official
maintenance releases of midPoint. The fix is provided in support
branch for midPoint 3.9.x. The fix is <strong>not</strong>
provided in support branches of midPoint 3.8.x and earlier due to a
code incompatibility. Fix for midPoint 3.8.x and earlier will be
provided on an explicit request of midPoint subscriber.<br>
<br>
Discussion and Explanation<br>
<br>
MidPoint provides "preview changes" functionality that can be used
to see changes that are about to be executed before actual
execution. This "preview" consists of several parts, e.g. the state
of the objects before the change, state of the objects after the
change, deltas that represent the change and so on. Authorizations
were applied to the objects in the preview section, but the
authorizations were not applied to the deltas. Therefore in case
that user's change caused a different change in items that the user
cannot see, that information may be leaked in the deltas.<br>
<br>
The fix for this vulnerability was not provided for midPoint 3.8.x
and earlier. The code has changed since the release of midPoint 3.8
and backport of the fix is not straightforward. As this is not a
serious vulnerability and the impact is very limited, we have chosen
to prioritize more serious issues and not spend development resource
to fix this issue in an old code. Users of midPoint 3.8.x and
earlier are advised to upgrade to midPoint 3.9. In a case that this
vulnerability is considered to be a serious risk for midPoint
subscribers running 3.8.x and 3.7.x that are not possible to
upgrade, such subscribers are advised to contact Evolveum and
request backport of this fix.<br>
<br>
Credit<br>
<br>
This issue was reported by Petr Gašparík<span
class="mini-profile__name spec-mini-profile-name"></span> by the
means of EU-Free and Open Source Software Auditing (EU-FOSSA2)
project.<br>
<br>
See Also<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+Authorizations+not+applied+properly+to+preview+changes">https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+Authorizations+not+applied+properly+to+preview+changes</a><br>
<br>
<pre class="moz-signature">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>