CyberRota Analysis
AI-GeneratedThe zlt2000 microservices platform versions up to 6.0.0 are vulnerable due to an unverified password change flaw in the PUT /users/password endpoint, allowing authenticated users to change any non-administrator account's password without validating the current password. This vulnerability poses a significant risk as it enables attackers to gain unauthorized access to user accounts by simply providing an arbitrary user ID and a new password. Organizations using this platform should prioritize immediate remediation to prevent potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.