Unprotected Password Change Function Leaves Application Vulnerable to Account Takeover

CVE-2024-28143

What is CVE-2024-28143?

The password change functionality exposed in the Image Access Management Interface allows for a significant security risk, as it does not require the entry of the current password by users. This flaw enables unauthorized individuals to reset user passwords via the -rsetpass+-aaction+- parameter, which may be exploited through Cross-Site Request Forgery (CSRF) techniques. Such an oversight poses a severe threat to the integrity and confidentiality of user accounts, making it imperative for users and administrators to apply the necessary patches provided by the vendor.

References