Common Weakness Enumeration
CWE-620
AllowedUnverified Password Change
Abstraction: Base · Status: Draft
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
181 vulnerabilities reference this CWE, most recent first.
CVE-2025-1107 (GCVE-0-2025-1107)
Vulnerability from cvelistv5 – Published: 2025-02-07 13:38 – Updated: 2025-02-12 20:51
VLAI
EPSS
VEX
Title
Unverified password change vulnerability in Janto
Summary
Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-07 14:32 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
1 reference
Date Public
2025-02-07 11:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T14:32:00.929994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:40.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Janto",
"vendor": "Impronta",
"versions": [
{
"lessThan": "r12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Guzm\u00e1n Fern\u00e1ndez Oca\u00f1a"
}
],
"datePublic": "2025-02-07T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user\u0027s password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint \u2018/public/cgi/Gateway.php\u2019."
}
],
"value": "Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user\u0027s password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint \u2018/public/cgi/Gateway.php\u2019."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-07T13:38:56.844Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "With the implemented patches by the Impronta team, the detected vulnerabilities have been fixed. All customers using this product in SaaS mode have been upgraded to version r12 which fixes these issues."
}
],
"value": "With the implemented patches by the Impronta team, the detected vulnerabilities have been fixed. All customers using this product in SaaS mode have been upgraded to version r12 which fixes these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unverified password change vulnerability in Janto",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2025-1107",
"datePublished": "2025-02-07T13:38:40.967Z",
"dateReserved": "2025-02-07T12:01:26.834Z",
"dateUpdated": "2025-02-12T20:51:40.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-51493 (GCVE-0-2024-51493)
Vulnerability from cvelistv5 – Published: 2024-11-05 18:17 – Updated: 2024-11-05 19:01
VLAI
EPSS
VEX
Title
API key access in settings without reauthentication in OctoPrint
Summary
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's or - if the victim has admin permissions - the global API key without having to reauthenticate by re-entering the user account's password. An attacker could use a stolen API key to access OctoPrint through its API, or disrupt workflows depending on the API key they deleted. This vulnerability will be patched in version 1.10.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-05 19:01 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/OctoPrint/OctoPrint/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T19:01:40.538581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:01:48.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OctoPrint",
"vendor": "OctoPrint",
"versions": [
{
"status": "affected",
"version": "\u003c 1.10.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim\u0027s OctoPrint browser session to retrieve/recreate/delete the user\u0027s or - if the victim has admin permissions - the global API key without having to reauthenticate by re-entering the user account\u0027s password. An attacker could use a stolen API key to access OctoPrint through its API, or disrupt workflows depending on the API key they deleted. This vulnerability will be patched in version 1.10.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T18:17:40.472Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-cc6x-8cc7-9953",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-cc6x-8cc7-9953"
}
],
"source": {
"advisory": "GHSA-cc6x-8cc7-9953",
"discovery": "UNKNOWN"
},
"title": "API key access in settings without reauthentication in OctoPrint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-51493",
"datePublished": "2024-11-05T18:17:29.812Z",
"dateReserved": "2024-10-28T14:20:59.337Z",
"dateUpdated": "2024-11-05T19:01:48.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-48887 (GCVE-0-2024-48887)
Vulnerability from cvelistv5 – Published: 2025-04-08 16:52 – Updated: 2026-02-26 18:28
VLAI
EPSS
VEX
Summary
A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-09 04:00 UTC
CWE
- CWE-620 - Escalation of privilege
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiSwitch |
Affected:
7.6.0
Affected: 7.4.0 , ≤ 7.4.4 (semver) Affected: 7.2.0 , ≤ 7.2.8 (semver) Affected: 7.0.0 , ≤ 7.0.10 (semver) Affected: 6.4.0 , ≤ 6.4.14 (semver) cpe:2.3:a:fortinet:fortiswitch:7.6.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.10:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.14:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.13:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.12:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.11:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.10:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiswitch:6.4.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-48887",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-09T04:00:34.789571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:28:37.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiswitch:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.14:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.13:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.12:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.11:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitch:6.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSwitch",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"lessThanOrEqual": "7.4.4",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.8",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.10",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.14",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Escalation of privilege",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T16:52:20.257Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-435",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-435"
}
],
"solutions": [
{
"lang": "en",
"value": "Please upgrade to FortiSwitch version 7.6.1 or above \nPlease upgrade to FortiSwitch version 7.4.5 or above \nPlease upgrade to FortiSwitch version 7.2.9 or above \nPlease upgrade to FortiSwitch version 7.0.11 or above \nPlease upgrade to FortiSwitch version 6.4.15 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-48887",
"datePublished": "2025-04-08T16:52:02.152Z",
"dateReserved": "2024-10-09T09:03:09.960Z",
"dateUpdated": "2026-02-26T18:28:37.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-47784 (GCVE-0-2024-47784)
Vulnerability from cvelistv5 – Published: 2025-04-30 18:17 – Updated: 2025-04-30 20:04
VLAI
EPSS
VEX
Title
Unverified Password Change
Summary
Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI
This issue affects ANC software version 1.1.4 and earlier.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-30 20:04 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
1 reference
Impacted products
Date Public
2025-04-30 05:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47784",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-30T20:04:37.536962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T20:04:47.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ANC",
"vendor": "ABB",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ANC-L",
"vendor": "ABB",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ANC-mini",
"vendor": "ABB",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-04-30T05:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI\u003cbr\u003eThis issue affects ANC software version 1.1.4 and earlier."
}
],
"value": "Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI\nThis issue affects ANC software version 1.1.4 and earlier."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/R:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T18:25:27.363Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=2CRT000006\u0026LanguageCode=en\u0026DocumentPartId=PDF\u0026Action=Launch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unverified Password Change",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2024-47784",
"datePublished": "2025-04-30T18:17:02.648Z",
"dateReserved": "2024-10-01T07:37:17.076Z",
"dateUpdated": "2025-04-30T20:04:47.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45647 (GCVE-0-2024-45647)
Vulnerability from cvelistv5 – Published: 2025-01-20 14:50 – Updated: 2025-01-21 20:08
VLAI
EPSS
VEX
Title
IBM Security Verify Access unverified password change
Summary
IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password.
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-21 20:07 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Security Verify Access |
Affected:
10.0.0 , ≤ 10.0.8
(semver)
cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:security_verify_access:10.0.8:*:*:*:*:*:*:* |
|
| IBM | Security Verify Access Docker |
Affected:
10.0.0 , ≤ 10.0.8
(semver)
cpe:2.3:a:ibm:security_verify_access_docker:10.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:security_verify_access_docker:10.0.8:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-21T20:07:29.261341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T20:08:31.459Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:security_verify_access:10.0.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Security Verify Access",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.0.8",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:security_verify_access_docker:10.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:security_verify_access_docker:10.0.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Security Verify Access Docker",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.0.8",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password."
}
],
"value": "IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620 Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-20T14:50:54.184Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7176212"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Security Verify Access unverified password change",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-45647",
"datePublished": "2025-01-20T14:50:54.184Z",
"dateReserved": "2024-09-03T13:50:17.060Z",
"dateUpdated": "2025-01-21T20:08:31.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41796 (GCVE-0-2024-41796)
Vulnerability from cvelistv5 – Published: 2025-04-08 08:22 – Updated: 2025-04-08 13:31
VLAI
EPSS
VEX
Summary
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-08 13:31 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | SENTRON 7KT PAC1260 Data Manager |
Affected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41796",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-08T13:31:19.338109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T13:31:32.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SENTRON 7KT PAC1260 Data Manager",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T08:22:14.357Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2024-41796",
"datePublished": "2025-04-08T08:22:14.357Z",
"dateReserved": "2024-07-22T13:19:53.377Z",
"dateUpdated": "2025-04-08T13:31:32.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37998 (GCVE-0-2024-37998)
Vulnerability from cvelistv5 – Published: 2024-07-22 13:54 – Updated: 2024-08-02 04:04
VLAI
EPSS
VEX
Summary
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affected applications can be reset without requiring the knowledge of the current password, given the auto login is enabled. This could allow an unauthorized attacker to obtain administrative access of the affected applications.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-24 16:50 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | CPCI85 Central Processing/Communication |
Affected:
0 , < V5.40
(custom)
|
|
| Siemens | SICORE Base system |
Affected:
0 , < V1.4.0
(custom)
|
|
| siemens | cpci85_firmware |
Affected:
0 , < 5.40
(custom)
cpe:2.3:o:siemens:cpci85_firmware:*:*:*:*:*:*:*:* |
|
| siemens | sicore_base_system |
Affected:
0 , < 1.4.0
(custom)
cpe:2.3:o:siemens:sicore_base_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:siemens:cpci85_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cpci85_firmware",
"vendor": "siemens",
"versions": [
{
"lessThan": "5.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:siemens:sicore_base_system:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sicore_base_system",
"vendor": "siemens",
"versions": [
{
"lessThan": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T16:50:47.506327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T16:56:51.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:04:24.632Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-071402.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "CPCI85 Central Processing/Communication",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICORE Base system",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \u003c V5.40), SICORE Base system (All versions \u003c V1.4.0). The password of administrative accounts of the affected applications can be reset without requiring the knowledge of the current password, given the auto login is enabled. This could allow an unauthorized attacker to obtain administrative access of the affected applications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T13:54:49.501Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-071402.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2024-37998",
"datePublished": "2024-07-22T13:54:49.501Z",
"dateReserved": "2024-06-11T08:32:52.184Z",
"dateUpdated": "2024-08-02T04:04:24.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-34077 (GCVE-0-2024-34077)
Vulnerability from cvelistv5 – Published: 2024-05-13 15:30 – Updated: 2024-08-02 02:42
VLAI
EPSS
VEX
Title
MantisBT user account takeover in the signup/reset password process
Summary
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-13 19:51 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mantisbt/mantisbt/security/adv… | x_refsource_CONFIRM |
| https://github.com/mantisbt/mantisbt/commit/92d11… | x_refsource_MISC |
| https://mantisbt.org/bugs/view.php?id=34433 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mantisbt:mantisbt:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mantisbt",
"vendor": "mantisbt",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34077",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-13T19:51:24.911983Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:42:02.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.849Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm"
},
{
"name": "https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00"
},
{
"name": "https://mantisbt.org/bugs/view.php?id=34433",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://mantisbt.org/bugs/view.php?id=34433"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mantisbt",
"vendor": "mantisbt",
"versions": [
{
"status": "affected",
"version": "\u003c 2.26.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user\u0027s password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token\u0027s validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305: Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-13T15:30:32.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm"
},
{
"name": "https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00"
},
{
"name": "https://mantisbt.org/bugs/view.php?id=34433",
"tags": [
"x_refsource_MISC"
],
"url": "https://mantisbt.org/bugs/view.php?id=34433"
}
],
"source": {
"advisory": "GHSA-93x3-m7pw-ppqm",
"discovery": "UNKNOWN"
},
"title": "MantisBT user account takeover in the signup/reset password process"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-34077",
"datePublished": "2024-05-13T15:30:32.334Z",
"dateReserved": "2024-04-30T06:56:33.383Z",
"dateUpdated": "2024-08-02T02:42:59.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-33699 (GCVE-0-2024-33699)
Vulnerability from cvelistv5 – Published: 2024-10-30 13:35 – Updated: 2024-10-30 15:03
VLAI
EPSS
VEX
Summary
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and gain higher privileges without the current password.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 14:32 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:levelone:wbr-6012:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wbr-6012",
"vendor": "levelone",
"versions": [
{
"status": "affected",
"version": "R0.40e6"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33699",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T14:32:18.184189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T14:33:00.816Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-10-30T15:03:14.534Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1984"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WBR-6012",
"vendor": "LevelOne",
"versions": [
{
"status": "affected",
"version": "R0.40e6"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Patrick DeSantis and Francesco Benvenuto of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "The LevelOne WBR-6012 router\u0027s web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and gain higher privileges without the current password."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T13:35:17.397Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1984",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1984"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-33699",
"datePublished": "2024-10-30T13:35:17.397Z",
"dateReserved": "2024-05-01T17:03:02.176Z",
"dateUpdated": "2024-10-30T15:03:14.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28143 (GCVE-0-2024-28143)
Vulnerability from cvelistv5 – Published: 2024-12-12 13:52 – Updated: 2025-11-03 21:54
VLAI
EPSS
VEX
Title
Insecure Password Change Function
Summary
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-13 16:05 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://r.sec-consult.com/imageaccess | third-party-advisory |
| https://www.imageaccess.de/?page=SupportPortal&lang=en | patch |
| http://seclists.org/fulldisclosure/2024/Dec/2 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Image Access GmbH | Scan2Net |
Affected:
0 , < 7.40
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-28143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-13T16:05:02.822864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-13T16:06:39.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:54:28.078Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Scan2Net",
"vendor": "Image Access GmbH",
"versions": [
{
"changes": [
{
"at": "7.40",
"status": "unaffected"
}
],
"lessThan": "7.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann (SEC Consult Vulnerability Lab)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. A\u003cspan style=\"background-color: var(--wht);\"\u003en attacker can use this to forcefully set a new password within the \u003cspan style=\"background-color: rgb(253, 253, 253);\"\u003e-rsetpass+-aaction+- parameter\u0026nbsp;\u003c/span\u003efor a user without knowing the old password, e.g. by exploiting a CSRF issue.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter\u00a0for a user without knowing the old password, e.g. by exploiting a CSRF issue."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.\u003cbr\u003e"
}
],
"value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620 Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-12T13:52:35.969Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/imageaccess"
},
{
"tags": [
"patch"
],
"url": "https://www.imageaccess.de/?page=SupportPortal\u0026lang=en"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor\u0027s customer server portal.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor\u0027s customer server portal."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insecure Password Change Function",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2024-28143",
"datePublished": "2024-12-12T13:52:35.969Z",
"dateReserved": "2024-03-05T09:15:40.202Z",
"dateUpdated": "2025-11-03T21:54:28.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
When prompting for a password change, force the user to provide the original password in addition to the new password.
Mitigation
Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
No CAPEC attack patterns related to this CWE.