Lucene search
BevennyamandeDA6745E4-7BCC-4E9A-9E96-0709EC9F2477HistoryAug 20, 2022 - 11:57 p.m.
Weak Password Change Mechanism
2022-08-2023:57:33
bevennyamande
www.huntr.dev
13
password change
user dashboard
bug bounty
EPSS
0.001
Percentile
17.8%
Description
The user password change page, doesn’t require knowledge of the existing password.
Proof of Concept
-
- Log in as a normal user
-
- Go to the User Dashboard page and click
User Settings.
- Go to the User Dashboard page and click
-
- Set a any new password.
-
- Click
confirm
- Click
-
- The password is changed successfully.
Related
veracode
veracode
Unauthorized Password Change
2022-08-22 16:57:07
github
github
Unverified Password Change in OctoPrint
2022-08-23 00:00:19
osv
osv
CVE-2022-2930
2022-08-22 12:15:09
Unverified Password Change in OctoPrint
2022-08-23 00:00:19
prion
prion
Default credentials
2022-08-22 12:15:00
cvelist
cvelist
CVE-2022-2930 Unverified Password Change in octoprint/octoprint
2022-08-22 11:35:11
nvd
nvd
CVE-2022-2930
2022-08-22 12:15:09
cve
cve
CVE-2022-2930
2022-08-22 12:15:09