•  
      request #10230 Email change confirmation code can be obtained without accessing the current email address
    Infos
    #10230
    Thomas Gerbet (tgerbet)
    2018-08-16 10:58
    2017-05-17 11:27
    10442
    Details
    Email change confirmation code can be obtained without accessing the current email address

    The current design of the change email address procedure allow to obtain the confirmation code without needing to access the current email address.

    Impact

    An attacker that can access another user account can use that to achieve a complete take over of the account and lock out the legitimate user.
    CVSSv3 score: 4.9 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)

    References

    CWE 330

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2018-08-16
    Attachments
    Empty
    References

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2018-08-16 10:58
    This has been handled by work done in request #11217.

    Disclosing the issue since it is fixed for a while now.

    • Status changed from Verified to Closed
    • Close date set to 2018-08-16