CVE-2015-8267

Critical

Published: 24/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before version 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.

Risk Assessment

Attackers can gain access to user accounts, potentially leading to data loss and security breaches within the organization.

Recommendation

It is recommended to upgrade to version 3.0.4.0 or later to secure the system against this vulnerability.

Original NVD description (English source)

The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.