Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
Applies To
- Windchill Risk and Reliability Enterprise Edition (Formerly Relex) 11.1 to 13.1
Excludes:
- Windchill Risk and Reliability (WRR) Team Edition
- Windchill
- FlexPLM
Description
- Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
- A CVE has not yet been published for this vulnerability
- Related CWEs
CWE-284 – Improper Access Control
The umbrella weakness for access control failures — the software doesn't properly restrict access to a resource from an unauthorized actor. This is the parent/catch-all CWE under OWASP A01:2021 Broken Access Control, used when a finding is clearly an access-control problem but doesn't fit a more specific sub-type (like CWE-862 Missing Authorization or CWE-863 Incorrect Authorization).
CWE-620 – Unverified Password Change
The application lets a user change a password without verifying the original/current password (or otherwise confirming the requester's identity). This enables an attacker who has temporary access to a session — or who can exploit CSRF — to take over an account by setting a new password.