Vulnerability in Textpattern

CVE-2008-5670

Textpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session.

EPSS: 0.012 (64.8th percentile) — read the EPSS interpretation.

Affected products

Textpattern — versions 4.0.5
N/a — versions n/a

Weakness classification (CWE)

CWE-255

References

cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (x_refsource_SREASON, third-party-advisory)