First Flight #1: PasswordStore

Summary

Event SetNetPassword() is emitted without parameters old and new passwords.

Vulnerability Details

It is good practice to log both the old and the new value when an event is emitted after a change of storage values, so one can easily find these changes in the logs.

Impact

Low.

Tools Used

n/a

Recommendations

Change the event to event SetNetPassword(string old_password, string new_password) so it's easier to know which password was changed into which when looking at the logs. Also important to remember that these should be (at least) encrypted, according to my other finding.