Vantage6 Brute-Force Vulnerability in Change Password Functionality

A vulnerability exists in Vantage6 versions prior to 4.11, allowing attackers with access to an authenticated session to brute-force user passwords. This is achieved by exploiting the change password feature, which can be repeatedly accessed until the correct password is entered. The absence of brute-force protection on this functionality creates a risk of unauthorized password changes.

Impact

Exploitation of this vulnerability could lead to unauthorized password changes, allowing an attacker to gain access to a user's account.

Remediation

Users can upgrade to Vantage6 version 4.11 or later to address this vulnerability.