When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.

Primary

Resultant

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Access Control
Bypass Protection Mechanism
Gain Privileges or Assume Identity

Architecture and Design
When prompting for a password change, force the user to provide the original password in addition to the new password.

Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.

This code changes a user's password.

$user = $_GET['user'];$pass = $_GET['pass'];$checkpass = $_GET['checkpass'];if ($pass == $checkpass) {SetUserPassword($user, $pass);}

While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account.

CVE-2007-0681
Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions.
https://www.cve.org/CVERecord?id=CVE-2007-0681

CVE-2000-0944
Web application password change utility doesn't check the original password.
https://www.cve.org/CVERecord?id=CVE-2000-0944

A3
Broken Authentication and Session Management
CWE More Specific

SFP31
Missing authentication

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2007-05-07
Draft 6
2007-05-07

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

Veracode
2008-08-15
Suggested OWASP Top Ten 2004 mapping

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-11-24
updated Observed_Examples

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2009-12-28
updated Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Observed_Examples, References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2018-03-27
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships, Type

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships