Weakness (CWE)
CWE-620: Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
How to prevent it (2 mitigations)
-
Architecture and Design
When prompting for a password change, force the user to provide the original password in addition to the new password.
-
Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
Source: MITRE CWE-620
9 results · Clear filters · Feed
-
Low 3.1
Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the p…
-
Low 2.7
Lantronix EDS3000PS Unverified Password Change
The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.
-
Low 2.7
vichan-devel vichan Password Change pages.php unverified password change
A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Password Change Handler. The manipulation of the argument Password leads to unverified password change. T…
-
Low 3.7
MOVEit Transfer REST API does not require current password in order to initiate the password change process
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
-
Low 3.8
TYPO3 Vulnerable to Unverified Password Change for Backend Users
TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, the backend user management interface allows password changes without requ…
-
Low 2.7
Unverified Password Change
An authenticated user attempting to change their password could do so without using the current password.
-
Low 2.6
Unverified Password Change
Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI This issue affects ANC software version 1.1.4 and earlier.
-
Low 3.3
Improper Authentication in zenml-io/zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vuln…
-
Low 2.7
Poly VVX 601 Configuration File Import unverified password change
A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, ED…