Magento2 EE plaintext administrative passwords output to log

this allows any user logged into the magento2 dashboard to see plaintext administrative passwords written to logs

affected versions are 2.1.3..2.1.6 at least

when user permissions are updated, the password of the administrator that makes the change is written to the logs in plaintext

1. go to the system configuration, and then to action log, and then report.
2. find a log entry with the action group "admin permissions users" and the action "save"
3. the current_password property in the "value after change" column will contain the administrative password

if no log entries exist you should create a user and then check again

one might have disclosed this responsibly if magento treated their community with respect