SDDC Manager API requests for Depot settings are disclosing the configured depot user credentials

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

On performing a request to get Depot Settings of SDDC Manager, the username and password used on to authenticate with the Depot will be disclosed.

 

For example: By executing the API DepotSettings in the Developer Center or calling it via url https://sddc_manager_fqdn/v1/system/settings/depot

 

Environment

SDDC Manager 5.1 and earlier

Cause

The methods used for the API to obtain the information was not considering the fact that the password for the depot authentication is external to the VCF.

Resolution

This is fixed on SDDC Manager 5.2