CVE-2023-2160: Modoboa has Weak Password Requirements

The vulnerability stems from insufficient validation in the password update process. The commit diff shows that the fix added server-side checks in the clean() method to require both 'newpassword' and 'confirmation' fields when either is present. Prior to this fix, the absence of these checks could allow partial submissions (e.g., providing a weak password without confirmation), potentially bypassing password strength enforcement. While the diff does not explicitly show password complexity checks, the CWE-521 classification and vulnerability description indicate that weak passwords were accepted, implying the validation logic in this function was incomplete or improperly enforced.