[JSPWIKI-45] Password change process should require old password

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 2.4.104, 2.5.139-beta, 2.6.0
• Fix Version/s: 3.0
• Component/s: Authentication & Authorization
• Assignee: Unassigned
• Reporter: Janne Jalkanen
• Created: 18/Nov/07 18:33
• Updated: 15/Nov/21 13:49
• Resolved: 10/Aug/08 13:25

Description

UserProfile.jsp does not require you to type in your old password to change the new password. This can be a problem if you inadvertently leave your computer open and someone gains access to it.

I think the old password should probably be required to change the email address as well, or else it could be used to restore the backend.

(From Ounce)

Issue Links

• is duplicated by: JSPWIKI-79 Ounce Labs Security Finding: Authentication - Change Password