Monero wallet password change is confirmed when not matching
Low
Vulnerability Details
## Summary:
If you change your wallet password in gui, the confirmation does not need to match the new password.
## Releases Affected:
* [list each version and OS of the application affected]
* [list each version and OS of the application affected]
## Steps To Reproduce:
Open your wallet.
Go to settings.
Change wallet password.
Enter old password.
You now have prompt with two passwords.
Enter your new password in the first line.
Leaving confirmation blank press enter.
Password is changed successfully without confirmation.
## Supporting Material/References:
I have personally attempted this many times.
## Housekeeping
1. Be sure to read our policy before submitting
2. Provide an XMR address within the report if you wish to receive bounty (assuming that the report is valid)
- PoC within a report will most likely result in more bounty than not
45vSCZ1DhEQCjXtPHzgr7m1jCkD31J9ZDCmDakuNV1Sw7mo5ywUPxVxXacJwtiBg7zdRQa4qjzy9Lg8NJdNMDdV3QH8xkPe
## Impact
User can lock themselves out of wallet.
Actions
View on HackerOneReport Stats
- Report ID: 803028
- State: Closed
- Substate: resolved
- Upvotes: 7