GitHub Advisoryadvisory · PyPI

GHSA-7wr6-fj4x-893v rdiffweb allows a new password to be the same as the previous password

MEDIUM Published 2022-10-06 Modified 2024-11-22 Official page ↗
Aliases
CVE-2022-3376
Ecosystem
PyPI
Packages
rdiffweb
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-521
Reviewed
2022-10-06

Affected packages

• PyPI rdiffweb: < 2.5.0 → fixed in 2.5.0

Description

rdiffweb prior to 2.5.0a4 allows users to set their new password to be the same as the old password during a password reset. Version 2.5.0a4 enforces a password policy in which a new password cannot be the same as the old one.

Related

Alias · CVE (1)

  • CVE-2022-3376 Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. vulnerability

Weakness · CWE (1)

  • CWE-521 Weak Password Requirements weakness

References