CyberRota Analysis
AI-GeneratedCrawlab's password-change endpoint lacks proper verification of user ownership or administrative roles, enabling any authenticated user to reset passwords for any account. This vulnerability allows attackers to enumerate user accounts and potentially change administrator credentials, leading to full account takeover and arbitrary code execution. Organizations using Crawlab should prioritize addressing this issue to prevent unauthorized access and protect sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.