CVE-2019-15749

Published: Oct 7, 2019Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account (e.g., via XSS or an unattended workstation) to change that password and address.

Affected (1)

Products: Sitos: Sitos Six

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sitos Sitos Six	Version 6.2.1

Related CWEs

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (2)

https://www.contextis.com/en/resources/advisories/cve-2019-15749

Source: cve@mitre.org

Third Party Advisory

https://www.contextis.com/en/resources/advisories/cve-2019-15749

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.