CVE-2025-1107 – Janto Password Change Encryption Bypass Vulnerability

The following table lists the changes that have been made to the CVE-2025-1107 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received by [email protected]

    Feb. 07, 2025

    Action Type Old Value New Value
    Added Description Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user’s password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
    Added CWE CWE-620
    Added Reference https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto