Check logs innovation sprint week 1

[JonellaCulmer]

Check logs Innovation sprint week 1

• Log review needs to be completed for innovation sprint week 1 per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

[lbeaufort]

• Kibana links for user change are broken - reach out to cloud.gov or re-create
• Determine status of [Snyk: High] XML External Entity (XXE) Injection (Due 07/10/2020) #4408 - verified as a false positive with Snyk CLI

Vulnerabilities:

FEC-CMS:
Total 3 issues, 7 vulnerabilites

package.json: 1
Medium: Prototype Pollution: fecgov/fec-cms#3740

requirements.txt: 6
Medium: Timing Attack in wagtail@2.7.2: fecgov/fec-cms#3777
Medium: (5 in one) Pillow vulnerabilities: fecgov/fec-cms#3886

openFEC:
Total 2

package.json: 1
Medium: Prototype Pollution #4337

data/flyway/build.gradle: 1
High: XML External Entity (XXE) Injection: #4408

FEC-EREGS:
None

FEC-PATTERN-LIBRARY:
None

Cloud.gov Dashboard: 9 deployer accounts, same as last week.
Offboarding: Nothing to report

[patphongs]

@lbeaufort I recreated the link to our kibana logs to check for user changes in our CMS. I have updated the security checklist link with this new short link.