apache / apache/cloudstack

No validation done when user resets a password

Open
#12,580 3 comments 0 reactions 0 assignees View on GitHub
no-issue-activity type:enhancement type:new-feature
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

### The required feature described as a wish

Steps to reproduce the issue

1. Enable the global setting "user.password.reset.enabled"

2. Click on forgot password option from the UI

Image

Image

Image

Image

3. User provides the same password, Cloudstack doesn't validate the password and sets the same password for the user

Expected behaviour

Cloudstack should validate if the same password is used for reset password, this can prevent security related issues

Contributor guide

Open the contributing guide

Research direction

Start by tracing the CloudStack password-reset flow from the UI after enabling "user.password.reset.enabled". Check where the submitted password is validated and verify that resetting to the existing password is rejected, using the reproduction steps and expected behavior as the completion criteria.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.