-
Defect (Security)
-
Resolution: Fixed
-
Major
-
3.0.0
-
Sprint 49 (Feb 2019), Sprint 50 (Mar 2019), Sprint 51 (Apr 2019)
-
0.5
In 3.0 we can set password in media type settings, but it's included as clear text to HTML when we open the media type settings, which is very insecure.
We had similar case in the past in ZBX-6721 (for ldap_bind password) and we fixed in a way that stored password is not returned to browser, user only may set it again by clicking "Change password" button, which is displayed if password is not set yet.