published August 28, 2019
⚠️ A custom service account’s credentials might be sitting pretty in plain sight! With Gallagher Command Centre 8.10, if you're using a visitor management service, your Windows username and password are logged in cleartext, ready for anyone to see. 🔍 Think of it like leaving your diary out in the open at a coffee shop — anyone can just walk by and read your secrets! The cleartext logging means that sensitive information is just laying there, waiting for someone to pick it up without any effort. This could lead to an unauthorized user gaining access to your system, potentially compromising sensitive data or even taking control of the service account. With your credentials on display, it’s like handing the keys to your kingdom to a stranger!
Think of it like leaving your diary out in the open at a coffee shop — anyone can just walk by and read your secrets! The cleartext logging means that sensitive information is just laying there, waiting for someone to pick it up without any effort. This vulnerability in Gallagher Command Centre 8.10 allows the Windows username and password for a custom service account to be logged in plain text to the Command_centre.log file during an upgrade, exposing sensitive data.
This could lead to an unauthorized user gaining access to your system, potentially compromising sensitive data or even taking control of the service account. With your credentials on display, it’s like handing the keys to your kingdom to a stranger! To mitigate this risk, upgrade to Gallagher Command Centre version 8.10.1092 (MR2) or later. Additionally, review your logging practices to ensure sensitive information isn’t recorded in plain text. Regularly audit your log files for any exposed credentials to prevent unauthorized access. You've got this! With a bit of diligence and the right upgrades, you can secure your system and keep those credentials under wraps! 🛡️