Lucene search

Th3l0newolfB031199D-192A-46E5-8C02-F7284AD74021

HistoryAug 25, 2023 - 5:05 p.m.

Unverified password change : old password can be used as new password

2023-08-2517:05:03

th3l0newolf

www.huntr.dev

unverified

password

change

old

new

policy

pimcore

platform

attacker

demo

user

credentials

security

vulnerability

bug bounty

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

Description

Pimcore Platform v 11.0.7 is not enforcing strict password policy which allow attacker to set old password as new password

Proof of Concept

1- go to https://demo.pimcore.com/admin/login
2- login with demo user credentials [ Username: superuser Password: enterprisedemo ]
3- Now login and click on -&gt; "superuser | My Profile".
4- Go to change password now put old password as new password and click save.

PoC

video PoC: https://drive.google.com/file/d/1eIRl5ilXDgQlz8AkZjqT9wn0irTCMcp8/view?usp=drive_link