CWE-620: Unverified Password Change
Base
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.
Consequences
- Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity
How to prevent it
- Architecture and Design: When prompting for a password change, force the user to provide the original password in addition to the new password.
- Architecture and Design: Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
Recent advisories
- GHSA-wmw3-3fv3-h54w — Concrete CMS has a session-hardening bypass and allows password change without reauthorization
- GHSA-wgx6-g857-jjf7 — OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
- GHSA-3jrg-97f3-rqh9 — TYPO3 Unverified Password Change for Backend Users
- GHSA-cc6x-8cc7-9953 — OctoPrint has API key access in settings without reauthentication
- GHSA-93x3-m7pw-ppqm — Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process
- GHSA-5626-pw9c-hmjr — OctoPrint Unverified Password Change via Access Control Settings
- GHSA-39gf-864w-pxw4 — Unverified Password Change in OctoPrint
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor