[PLUTO-782] Default "tomcat" and "pluto" users are granted "manager-gui" role

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 3.0.0, 3.0.1, 3.1.0
• Fix Version/s: 3.1.1
• Assignee: Neil Griffin (Inactive)
• Reporter: Louis
• Created: 24/Oct/19 04:26
• Updated: 14/Dec/22 14:37
• Resolved: 16/Dec/21 16:29

Description

Hi,

I just downloaded your software and saw that the passwords used to protect the local tomcat users are very predictable. It would be better to disable those accounts as they basically allow anyone to get command execution on the underlying server.

 

People in charge can then add those accounts based on their requirements.

Regards,

Louis