<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Date: 11 October 2019<br>
Severity: Low (CVSS 0.1 - 3.9)<br>
Affected versions: all released midPoint versions<br>
Fixed in versions: 4.0.1 (unreleased), 3.9.1 (unreleased), 3.8.1
(unreleased), 3.7.3 (unreleased)<br>
<br>
Description<br>
<br>
HTTP error codes used for REST authentication based on security
questions (a.k.a. SecQ) reveal user existence.<br>
<br>
Severity and Impact<br>
<br>
Attacker can use REST request to determine whether a user exists.
Attacker cannot gain access to any other information or any
unauthorized operation.<br>
<br>
Mitigation<br>
<br>
Users of affected MidPoint versions are advised to upgrade their
deployments to the latest builds from the support branches. <br>
<br>
As this is a low severity issue, it is not forcing official
maintenance releases of midPoint. However, the fix is provided in
all the support branches.<br>
<br>
Credit<br>
<br>
This issue was reported by <span class="mini-profile__name
spec-mini-profile-name">Nicolas Destor</span><span
class="mini-profile__name spec-mini-profile-name"></span> by the
means of EU-Free and Open Source Software Auditing (EU-FOSSA2)
project.<br>
<br>
See Also<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+HTTP+error+codes+used+for+SecQ+REST+authentication+reveal+user+existence">https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+HTTP+error+codes+used+for+SecQ+REST+authentication+reveal+user+existence</a><br>
<br>
<pre class="moz-signature">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>