Bug that allows user with no NCM access to pull from config archives

Thanks for reporting this. We have assigned this issue tracking number NCM-3979 internally.

Hi, just following up on this. Do we have an ETA for issue resolution?

Thanks!!

I can't give dates, but we are working on it.

Thanks for the update.

It seems like the account permission levels for NCM are just disregarded for API calls. We've also seen that an account with No NCM access can also invoke GetAllConnectionProfiles from Cirrus.Nodes and see all Connection Profile attributes - including the passwords.

It looks like that verb checks for "Node Management" rights, so it isn't wide open. But it should probably be checking for an appropriate role in NCM. I added a note about that verb specifically to the ticket.

Can we get a status update on issue NCM-3979? We recently upgraded to NCM v8.0 and the same security bugs still exist. This was reported in Aug 2018 and I was hopeful that by now it would have been addressed.

Thanks!!

This issue is not completely resolved yet, but it is actively being worked.  Related issue NCM-5227 has been updated earlier this month.