Cloud Platform
Hide about this portal


This is an IBM Automation portal for Cloud Platform products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.


Add a new idea Subscribe
Status Not under consideration
Workspace UrbanCode
Categories Deploy
Created by Guest
Created on May 17, 2023

RELATED IDEAS

Credentials are transmitted to server in plain text

See this idea on ideas.ibm.com

Dear Team,

As part of ASLC review by ICICI security team, Subjected point "Credentials are transmitted to server in plain text" is open for fix. To close this point, We have been following up with Osman (Product Team) from several months since it cannot be fixed with usual process. As per ICICI security team, this should be closed and may not get further extension for exception. 

Report from ICICI Security team and other details attached.

""Credentials are transmitted to server in plain text: Open

Justification: An adversary can strip SSL and intercept plain text credentials using sniffer tools like fiddler, burp suite. Credentials thus obtained may be used to gain unauthorized access to the application.""

For your reference, please find the PoC of another application where credentials are being transmitted in an encryption manner.

FYR, Vendor has raised PMR case with subject "UCD 7.1.2.0 Security Scan result review request. "

Thanks

Jyothi Boddu

ASLC Review_Ope...
Re ICICI - ASL...
PoC of sample a...
ASLC Review_Open Point.xlsx
 ASLC Review_Open Point.xlsx
Re ICICI - ASLC Open Point Credentials are transmitted to server in plain text.msg
 Re ICICI - ASLC Open Point Credentials are transmitted to server in plain text.msg
PoC of sample application.png
ASLC Review_Open Point.xlsx Re ICICI - ASLC Open Point Credentials are transmitted to server in plain text.msg PoC of sample application.png
Idea priority High
  • Admin
    Randy Langehennig
    Reply
    |     May 31, 2023

    Thank you for this idea and sorry for delay in response. We are going to meet internally to discuss this RFE and following this we will be meeting with you as well to provide an update. Thank you again for your submission of this Idea.

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.