Weakness (CWE)
CWE-620: Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
How to prevent it (2 mitigations)
-
Architecture and Design
When prompting for a password change, force the user to provide the original password in addition to the new password.
-
Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
Source: MITRE CWE-620
111 results · Feed
-
Medium 5.3
API key access in settings without reauthentication in OctoPrint
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser sessio…
-
Critical 9.9CVE-2024-33699 EPSS 11%
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers …
-
Medium 5.3
BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset
The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it po…
-
Medium 5.5
A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and …
-
Critical 9.8
An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 …
-
Critical 9.8
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base syst…
-
Critical 10.0
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unaut…
-
High 8.2
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privil…
-
Low 3.3
Improper Authentication in zenml-io/zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vuln…
-
High 7.3
MantisBT user account takeover in the signup/reset password process
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request p…
-
Medium 4.2
OctoPrint Unverified Password Change via Access Control Settings
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An…
-
Low 2.7
Poly VVX 601 Configuration File Import unverified password change
A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, ED…
-
High 8.1
Expired tokens can be renewed without validating the account password
### Impact In versions of the proxy from `2022-09-05` onwards (since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f), expired OAuth 2.0 client credentials grant (CCG) flow authorisation tokens could be renewed automatically without checking their validity against t…
-
Critical 9.8
UserPro <= 5.1.1 - Insecure Password Reset Mechanism
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_pr…
-
High 8.1
AppPresser <= 4.2.5 - Insecure Password Reset Mechanism
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
-
Medium 4.3
Unverified Password Change in pimcore/admin-ui-classic-bundle
Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
-
Medium 5.3
WP User Control <= 1.5.3 - Insecure Password Reset Mechanism
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in…
-
Medium 4.3
Unverified Password Change in instantsoft/icms2
Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
-
High 7.6
Unverified Password Change in tsolucio/corebos
Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
-
Critical 9.8
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient vali…
-
Medium 6.4
Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue
Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the c…
-
Critical 9.6
Unverified Password Change in phpfusion/phpfusion
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.
-
Medium 5.3
Unverified Password Change in octoprint/octoprint
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
-
High 7.5
Metasys password guessing
A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.
-
High 8.0
Metasys Unverified Password Change
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.
-
Medium 6.5
Cisco BroadWorks CommPilot Application Software Vulnerabilities
Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.
-
Medium 6.5
Cisco BroadWorks CommPilot Application Software Vulnerabilities
Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.
-
Unscored —
A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R…
-
Critical 9.1CVE-2020-7378 Public exploit
CRIXP OpenCRX Unverified Password Change
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen va…
-
Medium 6.3
Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allo…
-
Unscored —
An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a…