CVE-2018-8916
08.06.2018, 13:29
Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.Enginsight
| Vendor | Product | Version |
|---|---|---|
| synology | diskstation_manager | 𝑥 < 6.2-23739 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-620 - Unverified Password ChangeWhen setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
- CWE-640 - Weak Password Recovery Mechanism for Forgotten PasswordThe software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.