Published: 07/02/2025 Updated: 07/02/2025

Unauthenticated Password Change Vulnerability in Janto Versions Prior to r12

An unverified password change vulnerability exists in Janto versions before r12. This security issue allows an unauthenticated attacker to modify another user's password without knowing their current password. The vulnerability can be triggered by crafting a specific POST request directed to the '/public/cgi/Gateway.php' endpoint. An attacker could potentially change passwords for any user in the system by sending the maliciously constructed request.

With the implemented patches by the Impronta team, the detected vulnerabilities have been fixed. All customers using this product in SaaS mode have been upgraded to version r12 which fixes these issues.

Vulnerable Product	Search on Vulmon	Subscribe to Product
impronta janto

CWE-620 https://nvd.nist.gov https://www.first.org/epss https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2025-1107

Vulnerability Summary

Solution

Vulnerability Trend

References

Vulmon Search

About

Products

Connect