B3log Solo view any User Password

An interactive interface without reasonable permission verification on the B3log Solo background allows you to view any user information, including the plaintext password. Currently, the latest official Release 0.5.5 is affected by this vulnerability. All Platform Users are threatened with password leakage. Vulnerability address: http: // xxx/console/user/[userId] This interface is used to view user information. It is an interface used by the administrator user management plug-in. This interface only verifies whether the user is logged on, but does not verify the user permissions. Although there is no explicit link in the background management interface of a common user, you can directly access this address to obtain information after logging on.Solution:1. Change the plaintext password to ciphertext. 2. Added permission verification.