EventSentry Web Reports Unverified Password Change Vulnerability Allowing Account Takeover

A vulnerability allowing unverified password changes has been identified in the EventSentry Web Reports interface, affecting versions prior to 6.0.1.20. The issue arises because the password change feature does not require validation of the current password before a new password can be set. This flaw enables an attacker with temporary access to an authenticated user session to change the account password, leading to persistent account takeover. If an administrative account is compromised, it could result in privilege escalation.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeover. If an administrative account is compromised, it could result in privilege escalation.

Remediation

Users can upgrade to EventSentry version 6.0.1.20 or later to address this vulnerability.