<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><div><div>Date: 27. 02. 2024</div><div>Severity: 6.4 (Medium)</div><div>Affected versions: All midPoint versions from 4.7 prior to 4.7.4, 4.8.2</div><div>Fixed in versions: 4.7.4, 4.8.2</div><br><div>Description</div><br><div>Panels that contain a configuration for visibility as 'hidden' are not displayed in the menu, but they can be displayed by changing the identifier in the 'panelId' URL parameter.</div><br><div><br data-mce-bogus="1"></div><div>Severity and Impact</div><br><div>This is Medium Severity Issue.</div><div>MidPoint contains a configuration for the visibility of the panel as 'hidden' (for example, a panel for organization assignments with the identifier 'orgAssignments').</div><div>Users with GUI authorization for the details page (for example, http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfProfile)</div><div>and model authorizations for the objects displayed in the hidden panel (for example, read/write for the OrgType) can do the following:</div><br><div>The user opens a details page with panels (for example, a profile page) and changes the 'panelId' parameter in the URL to the hidden panel identifier (for example, 'orgAssignments').</div><div>The content of the hidden panel is displayed.</div><br><div><br data-mce-bogus="1"></div><div>Mitigation</div><br><div>Users of affected MidPoint versions are advised to upgrade their deployments to the latest maintenance releases.</div><div>In the meantime, users are advised to limit model authorizations to only necessary objects and object items.</div><br><div>This advisory is also available at <a href="https://docs.evolveum.com/midpoint/security/advisories/024-showing-hidden-panel/">https://docs.evolveum.com/midpoint/security/advisories/024-showing-hidden-panel/</a><br><br><br><br><pre style="white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">--
Anton Tkáčik
Software Developer
evolveum.com </pre> </div></div></div></div></body></html>