Description
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Image Access | Scan2Net | < 7.40 | 7.40 |
References
- https://r.sec-consult.com/imageaccess third-party-advisory
- https://www.imageaccess.de/?page=SupportPortal&lang=en patch