ID: 6709
Title: Fixed possible information disclosure to apache log when editing users
Component: WATO
Level: 1
Class: Security fix
Version: 1.6.0i1
An administrator has the ability to create new users. The credentials of a
newly created user were visible within the HTML of the resulting web page as
GET parameter of various hyperlinks. If one of these links was clicked, the
credentials were stored in the administrator’s browser history and in the access
logs of the server.
Show replies by date