CVE-2021-29394

MEDIUM

6.5

CVSS Severity Score

EPSS Score0.0900%

EPSS Percentile36.98th

PublishedFeb 4, 2022

Last ModifiedNov 21, 2024

Vulnerability Description

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST request.

Affected Platforms (CPE)

📦

Globalnorthstar

Northstar Club Management

= 6.3

References & Advisories

🔗 https://ardent-security.com

🔗 https://ardent-security.com/en/advisory/asa-2021-02/