Account Limitation - Security Gap

I found out this morning that if a user is limited with only a single interface limitation, they can still see the parent node and all other nodes in the system (though with no interfaces visible). This is the case on both our 9.5 SP4 and 9.5 SP3 installations.

Prior to 9.5, if you specified a single interface, that would be all the account could see...no parent (or other) node.

I opened case #116594 this morning about 5 1/2 hours ago as "Urgent" but have not received a follow up yet.

This is of fairly high importance for us as one of our installs is used to give our customers visibility into their own connections and we would rather they not be able to see anything else.

Find more posts tagged with

account_view

9.5_upgrade

account_limitation

account_limitation_website_error

Accepted answers

All comments

njoylif

I do not have "head end" nodes, but do have interfaces off them, and the remote "customer" devices.
my remotes are working fine, the head end interfaces are showing not permitted. The interfaces are explicitly allowed in permissions, so I'd love to hear what support says.. Please post when they respond.

Thanks