Unverified Password Change
CWE-620
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
We track 62 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8.
How this weakness is prevented
- Architecture and Design: When prompting for a password change, force the user to provide the original password in addition to the new password.
- Architecture and Design: Do not use forgotten password functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
Latest Unverified Password Change vulnerabilities
- 9.8 Critical severity
Flynax Bridge: Unverified Password Change
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. Th
- 9.8 Critical severity
FortiSwitch: Unverified Password Change
A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request
- 8.8 High severity
transformeroptimus/superagi: Unverified Password Change
In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover.
- 8.1 High severity
Exertio Framework: Unverified Password Change
The Exertio Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.1. This is due to the plugin not properly validating a user's identity prior to updating their password through the
- 9.8 Critical severity
Nokri – Job Board WordPress Theme: Unverified Password Change
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their deta
- 9.8 Critical severity
CarSpot – Dealership Wordpress Classified Theme: Unverified Password Change
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's
- 9.9 Critical severity
Janto: Unverified Password Change
Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific P
- 9.8 Critical severity
Security Verify Access: Unverified Password Change
IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password.
- 9.8 Critical severity
Adifier System: Unverified Password Change
The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to the plugin not properly validating a user's identity prior to updating their details like password th
- 8.4 High severity
Scan2Net: Unverified Password Change
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user
- 8.8 High severity
WBR-6012: Unverified Password Change
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and gain higher privileges without the current password.
- 7.8 High severity
FortiManager: Unverified Password Change
A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4
- 9.8 Critical severity
restaurant_digital_comprehensive_management: Unverified Password Change
An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets.
- 9.8 Critical severity
CPCI85 Central Processing/Communication: Unverified Password Change
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affected applications can be reset without requiring the knowledge
- 10.0 Critical severity
Cisco Smart Software Manager On-Prem: Unverified Password Change
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper impleme
- 8.2 High severity
web_product: Unverified Password Change
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism.
- 7.3 High severity
mantisbt: Authentication Bypass by Primary Weakness
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pe
- 9.8 Critical severity
UserPro - Community and User Profile WordPress…: Unverified Password Change
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_pro
- 9.8 Critical severity
AppPresser – Mobile App Framework: Weak Password Recovery Mechanism for Forgotten Password
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
- 8.1 High severity
User Profile Builder – Beautiful User…: Improper Authentication
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient valid
- 7.5 High severity
Metasys ADS/ADX/OAS server: Improper Authentication
A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.
- 8.8 High severity
Metasys ADS/ADX/OAS server: Improper Authentication
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.