CVE-2019-15749

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password

published October 7, 2019

CVSS
—
EPSS
1%
Percentile
62.0
In the wild
Unconfirmed
What it is

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account (e.g., via XSS or an unattended workstation) to change that password and address.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00985 · 62.0th percentile
Published
2019-10-07T11:41Z
EPSS history
Timeline
  • 07 OCT 11:41Z
    SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password
    cvelistv5