New password can be set as same as the old password in instantsoft/icms2
Reported on
Aug 14th 2023
Description
The web application allows us to set new password as the old one at Password change function.
Detail:
1/ Access to the demo website and go to My profile.
2/ Choose Edit profile, at the Security tab, change the password with the new password and the old password are the same.
3/ Logout and login again to verify that it's successful.
Proof of Concept
Link video PoC: https://drive.google.com/file/d/1b-iMln3MIowU1LAz9DiZtxygPpEz9oNJ/view?usp=sharing
Impact
If users are required to change their password, but they can reuse an old password, the effectiveness of a good password policy is greatly reduced
Occurrences
CWE-620 does not fit the described problem. But in general you are right, you can't let them change the password to what it was before. I'm not sure it can be considered a security issue.
Hi @Fuze, I think it is also a security issue. If following OWASP checklist, it will be WSTG-ATHN-07 Testing for Weak Password Policy. Whatever you decide, I respect it. Thank you.