PAM Standalone Credential password viewable without checkout

Implemented

PAM Standalone Credential password viewable without checkout

avatar
jm2

Hello,

For most PAM credentials, a checkout is required to view the password, however it appears in the case of StandAlone type entries, users with the role contributor (and above), the password is viewable simply by entering the edit credential screen in the web GUI. This bypasses logging of who/when accessed the password.

Using DVLS 2023.3.12

Pls let me know if you would like additional info.

Thanks
Joe


All Comments (3)

avatar
Samuel Dery

Hello Joe,

Thank you for reaching out to us regarding this,

From my understanding, a log should be generated when the entry Properties is accessed by the user, is that not the case on your end?

You would like to have an additional log be created specifically if the users reveal the password when accessing the "Properties"?

Let me know,

Best regards,

Samuel Dery

avatar
Marc-Andre Bouchard

Hi

You're right, you shouldn't be able to see the password during an edit. I will create a ticket to fix this.

Best regards

Marc-Andre Bouchard

avatar
jm2

sounds good, thanks Marc-Andre