CWE-620: Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- medtronic interstim x clinician, micro clinician, insterstim applications +2 moreMedtronic Micro Clinician & InterStim X Clinician App Password Reset Issue6.4 Medium
- php-fusion phpfusion, phpfusion phpfusion/phpfusion +1 moreUnverified Password Change in phpfusion/phpfusion9.6 Critical
- octoprint, octoprint octoprint/octoprint +1 moreUnverified Password Change in octoprint/octoprint5.3 Medium
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys password guessing7.5 High
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys Unverified Password Change8.0 High
- cisco broadworks commpilot application software, broadworks +1 moreCisco BroadWorks CommPilot Application Software Vulnerabilities6.5 Medium
- cisco broadworks commpilot application software, broadworks +1 moreCisco BroadWorks CommPilot Application Software Vulnerabilities6.5 Medium
- schneider-electric evlink city evc1s22p4 firmware, evlink city evc1s7p4 firmware, evlink parking ev.2 firmware +3 more +5 moreA CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4...6.5 Medium
- crixp opencrxCRIXP OpenCRX Unverified Password Change9.1 Critical
- synology diskstation manager (dsm), diskstation manager +1 moreUnverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM)...6.3 Medium
- prominent multiflex m10a controller firmwareAn Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web...8.8 High