Janssen Project Password Logging Vulnerability in CLI Tool

A vulnerability exists in the Janssen Project CLI tool, specifically in version 1.9.0 and prior, where passwords are logged in plaintext in the local 'cli_cmd.log' file. This issue has been addressed in the nightly prerelease and version 1.10.0.

Impact

This vulnerability could lead to unauthorized access to sensitive information, as plaintext passwords could be read by anyone with access to the log file.

Reproduction

The vulnerability can be reproduced by using the Janssen CLI tool to create a user or change a user's password. The password will be logged in plaintext in the 'cli_cmd.log' file.

Remediation

Users can upgrade to the nightly prerelease or version 1.10.0 to address this vulnerability.