CVE-2021-29394: Globalnorthstar Northstar Club Management

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST request.

Affected products

• Globalnorthstar Northstar Club Management: version 6.3 only

Published 2022-02-04. Last modified 2026-06-17.