chad at opensourcery
Apr 16, 2009, 9:39 AM
Views: 481
Permalink
|
|
*possible* RT security bug
|
|
Version 3.8.2
Noticed when writing a plugin. I have debugging that prints out the
content of %ARGS. I went to the page while not logged in, it prompted
for login. Logged in and it redirected to the page I am working on. the
debugging showed the username and password in %ARGS.
I would expect the username and password to be stripped from %ARGS the
moment the login validation stage is complete (on success or failure). I
do not have any clear ideas on how to exploit this, but it seems pretty
sketch.
-Chad Granum
|
signature.asc
*possible* RT security bug
