CVE-2021-29394

2022-02-0418:47:04

mitre

www.cve.org

hijacking

northstar

user accounts

authorization

vulnerability

http_post

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

34.9%

JSON

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled “userID” parameter of the HTTP POST request.

References

ardent-security.com

ardent-security.com/en/advisory/asa-2021-02/