search

w3c / webappsec-change-password-url

A Well-Known URL for Changing Passwords
https://w3c.github.io/webappsec-change-password-url/
Other
899 stars 27 forks source link

Expand security considerations section #19

Open hober opened 4 years ago

hober commented 4 years ago

@terriko raised this concern on public-webappsec:

I do wonder if we should (non-normatively) mention the concern that having a well-known password change url could be used for nefarious purposes (e.g. sending a lot of emails, denial of service if there’s a rate limit on password changes, authentication attacks against security questions, etc.).

nsonaniya2010 commented 4 years ago

Missing Function Level Access Control issue. Possibly this functionality may be hidden till user is privileged. and Hence, this allows a low privileged, or unprivileged user to access restricted functionality in the application.