An unverified password change vulnerability in EventSentry Web Reports allows authenticated attackers to hijack user accounts, posing a significant risk of unauthorized access and privilege escalation.

This is an unverified password change vulnerability (CWE-620) located in the account management functionality of the Web Reports interface. It requires an attacker to have access to an authenticated user session to trigger the flaw, as the system fails to validate the current password before accepting a new one.

The ability for an attacker to modify passwords without knowledge of existing credentials facilitates persistent account takeover. Given the CVSS score of 8.8, this vulnerability is classified as High severity. Successful exploitation could lead to full compromise of user accounts, and if administrative accounts are targeted, it allows for complete unauthorized control over the EventSentry environment and potential lateral movement within the network.

Immediate Action: Update the EventSentry software to version 6.0.1.20 or later to ensure the password change mechanism requires current credential verification.

Proactive Monitoring: Review web server and application access logs for unusual account management activity or multiple password change requests originating from the same session.

Compensating Controls: Implement strict session timeout policies and monitor for anomalous login patterns to minimize the window of opportunity for an attacker to utilize an existing authenticated session.

Public Exploit Available: Unknown

The vulnerability presents a high risk to organizational security by enabling account takeover through a simple logic flaw. Security teams must prioritize updating the EventSentry Web Reports interface to the patched version immediately. Failure to remediate this issue leaves sensitive administrative accounts exposed to unauthorized modification and potential full system compromise.