Description
SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account (e.g., via XSS or an unattended workstation) to change that password and address.
Scores
CVSS v3
6.5
EPSS
0.0021
EPSS Percentile
43.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Details
CWE
CWE-640
Status
published
Products (1)
sitos/sitos_six
6.2.1
Published
Oct 07, 2019
Tracked Since
Feb 18, 2026