Check impersonation on ACL evaluation in HR App [New in Security Center 1.3and updated in 1.5]
Use the sn_hr_core.impersonateCheck property to prevent a user from impersonating another user and accessing their HR information.
A secure setting prevents an admin from seeing another user's HR information while using impersonation. An insecure setting for this property allows an admin to impersonate a user and access HR data such as survey results or audit records with the impersonated user's access. Due to the nature of this type of data, such as information which should be available only to the user themselves like email, this is not recommended. Setting sn_hr_core.impersonateCheck to true only allows access to HR information when the user is not impersonating any others.
More information
| Attribute | Description |
|---|---|
| Configuration name | sn_hr_core.impersonateCheck |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Category | Architecture, design, and threat modeling |
| Security risk | - Severity score: 2.7 - CVSS score: Low - Security risk details: An insecure setting for this property allows an admin to impersonate a user and access HR data such as survey results or audit records with the impersonated user's access. |
| Dependencies and prerequisites | None |
| Functional impact | When this property set to true, it prevents an admin from seeing another user's HR information while using impersonation. When set to false, it allows an admin to impersonate a user and access HR data such as survey results or audit records with the impersonated user's access. Due to the nature of this type of data, such as information which should available only to the user themselves like an email, this is not recommended. Setting sn\_hr\_core.impersonateCheck to true only allows access to HR information when the user is not impersonating any others. |
Parent Topic:Architecture, design, and threat modeling