CVE-2020-25566

In SapphireIMS 5.0, it is possible to take over an account by sending a request to the SavePassword form as shown in POC. Notice that we do not require a JSESSIONID in this request and can reset any user’s password by changing the username to that user and password to base64desired password...

CVE-2020-25566

CVE-2020-25566 affects SapphireIMS 5.0, where the Save_Password form can be abused to take over any account without a JSESSIONID. An unauthenticated attacker can reset a target user’s password by sending a crafted request that swaps the username and sets the password to a base64(desired password)...