Description
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zlt2000 | microservices-platform | ≤ 6.0.0 | — |
References
- Password change endpoint takes the target account id from the request body, at v6.0.0 technical-description
- Current-password check is skipped when oldPassword is blank, at v6.0.0 technical-description
- Reporter proof of concept: set another account's password without the current one exploit
- zlt2000/microservices-platform product
- VulnCheck Advisory: microservices-platform through 6.0.0 Unverified Password Change via /users/password third-party-advisory