<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><div><div><div>Date: 27. 02. 2024</div><div>Severity: 8.5 (High)</div><div>Affected versions: All midPoint versions prior to 4.4.8, 4.7.4, 4.8.2</div><div>Fixed in versions: 4.4.8, 4.7.4, 4.8.2</div><br><div>Description</div><br><div>If a user is authorized to submit raw XML/JSON/YAML object data to midPoint (typically, when adding or modifying an object), they can execute arbitrary script code provided as part of that data.</div><div>The code is executed before the authorization check stops the operation.</div><br><div>Severity and Impact</div><br><div>This is High Severity Issue.</div><div>Exploitation of this issue requires the ability to submit XML/JSON/YAML data to midPoint.</div><div>Normally, users are not able to do so.</div><div>The exception is, e.g., when they are allowed to use the REST API or access the Repository Objects page.</div><br><div>Mitigation</div><br><div>Users of affected MidPoint versions are advised to upgrade their deployments to the latest maintenance releases.</div><br><div>In the meantime, they are advised to allow Repository Objects and/or REST access only to trusted users.</div><br><div>This advisory is also available at <a href="https://docs.evolveum.com/midpoint/security/advisories/022-unauthorized-code-execution/">https://docs.evolveum.com/midpoint/security/advisories/022-unauthorized-code-execution/</a></div><div><br></div></div></div></div><pre style="white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">--
Anton Tkáčik
Software Developer
evolveum.com </pre><br></div></div></body></html>