<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><div><div>Date: 27. 02. 2024</div><div>Severity: 8.2 (High)</div><div>Affected versions: All midPoint versions prior to 4.4.8, 4.7.4, 4.8.2</div><div>Fixed in versions: 4.4.8, 4.7.4, 4.8.2</div><br><div>Description</div><br><div>Authorized REST users can inject false resource data into midPoint and invoke the import from resources without any further authorizations.</div><br><div>Severity and Impact</div><br><div>This is High Severity Issue.</div><div>Users with `http://midpoint.evolveum.com/xml/ns/public/security/authorization-rest-3#all` authorization can do the following:</div><div>- Invoke "notify change" operation.</div><div>It allows them to provide false resource data to midPoint.</div><div>- Invoke "import from resource" operations.</div><div>They allow them to start the import operations, either for a single shadow, or for the whole object class.</div><div>- Test the resource.</div><br><div>Mitigation</div><br><div>Users of affected MidPoint versions are advised to upgrade their deployments to the latest maintenance releases.</div><br><div>In the meantime, they are advised to allow REST access only to trusted users.</div><br><div>This advisory is also available at <a href="https://docs.evolveum.com/midpoint/security/advisories/023-unauthorized-operation-execution/">https://docs.evolveum.com/midpoint/security/advisories/023-unauthorized-operation-execution/</a></div><div><br data-mce-bogus="1"></div><pre style="white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">--
Anton Tkáčik
Software Developer
evolveum.com </pre><br></div></div></div></body></html>