CVE-2019-19857

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-19857
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19857.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-19857
Published
2020-01-15T23:15:11Z
Modified
2026-08-27T08:15:16Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change Password screen does not enhance security. This is problematic in conjunction with XSS.

References

Affected packages

Git / github.com/BuffaloWill/Serpico

Affected ranges

Type
GIT
Repo
https://github.com/BuffaloWill/Serpico
Events
Introduced
7d7bc536b4de1f10e1e0feff0e5804150383b917
Last Affected
7d7bc536b4de1f10e1e0feff0e5804150383b917
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:serpico_project:serpico:1.3.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.3.0"
        },
        {
            "last_affected": "1.3.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*
1.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19857.json"