Attacker can read password from log data

How it was found

Summary:

Attacker can read plain text password from log data.

Steps To Reproduce:

1. From application dashboard choose Users section, I simultaneously ran process hacker to see the process disk write and read behavior.
2. change the password of one of the users, and you see in process hacker window the place for log data creation.
3. Open the file in favorite editor in that place: %UserProfile%\AppData\Local\Temp\tomcat.1470616378544174392.8080\work\Tomcat\localhost\midpoint

Supporting Material/References:

I have uploaded a video for POC.

Impact

Attacker can read plain text password from log data.