cve.bz

CWE-620: Unverified Password Change, page 3

Filter

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

What the weakness is: CWE-620 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Ask an AI about CWE-620

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-620: Unverified Password Change and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/620.html and https://cve.bz/cve/cwe/620?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2022-2930EPSS 0.3%

    Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

  2. 7.5CVE-2022-21935EPSS 1.0%

    A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.

  3. 8.8CVE-2022-21934EPSS 1.0%

    Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.

  4. 4.9CVE-2021-34786EPSS 1.0%

    Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.

  5. 7.2CVE-2021-34785EPSS 1.3%

    Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.

  6. 6.5CVE-2021-22773EPSS 0.8%

    A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all …

  7. 9.1CVE-2020-7378EPSS 2.6%

    CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standa…

  8. 8.8CVE-2018-8916EPSS 1.0%

    Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.

  9. 8.8CVE-2017-14005EPSS 1.4%

    An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is au…