Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-28865

CVE-2020-28865: Insufficiently Protected Credentials in PowerJob

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-28865
GHSA ID
GHSA-w4q4-jcm7-g4m6
EPSS Score
0.374%
CWE
CWE-522
Published
6/17/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.github.kfcfans:powerjobmaven< 3.3.33.3.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the absence of old password verification in the password update flow. The patch added a critical check comparing the submitted oldPassword with the stored password (via Objects.equals(req.getOldPassword(), appInfoDO.getPassword())). The vulnerable version's saveAppInfo() function in AppInfoController.java processed modification requests without this authentication step, allowing unauthorized password changes by ID manipulation. The direct correlation between the attack vector (/appinfo/save endpoint) and the patched code in this function confirms its vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in Pow*rJo* t*rou** *.*.*, *llows *tt**k*rs to ***n** *r*itr*ry us*r p*sswor*s vi* t** i* p*r*m*t*r to /*ppin*o/s*v*.

Reasoning

T** vuln*r**ility st*ms *rom t** **s*n** o* ol* p*sswor* v*ri*i**tion in t** p*sswor* up**t* *low. T** p*t** ***** * *riti**l ****k *omp*rin* t** su*mitt** ol*P*sswor* wit* t** stor** p*sswor* (vi* `O*j**ts.*qu*ls(r*q.**tOl*P*sswor*(), *ppIn*o*O.**tP