CVE-2004-1263: Changepassword

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

changepassword.cgi in ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious "make" program.

Affected products

• Changepassword Changepassword: version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; version 0.6 only; …

Published 2005-01-10. Last modified 2026-06-16.