Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #10230 Email change confirmation code can be obtained without accessing the current email address
    Actions
    Infos
    #10230
    Thomas Gerbet (tgerbet)
    2018-08-16 10:58
    2017-05-17 11:27
    10492
    Details
    Email change confirmation code can be obtained without accessing the current email address

    The current design of the change email address procedure allow to obtain the confirmation code without needing to access the current email address.

    Impact

    An attacker that can access another user account can use that to achieve a complete take over of the account and lock out the legitimate user.
    CVSSv3 score: 4.9 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)

    References

    CWE 330

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2018-08-16
    Attachments
    Artifact links
    Empty
    Empty
    References
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2018-08-16 10:58
    This has been handled by work done in request #11217.

    Disclosing the issue since it is fixed for a while now.
    • Status changed from Verified to Closed
    • Close date set to 2018-08-16