Solved Change password process insecure

[stephan23]

I wanted to change my email address on my account ( on customer.3cx.com > My Account ). I noticed that there is an insecurity in the current process.

Lest assume I want to change my email address from [email protected] to [email protected], 3cx sends an email to [email protected] to verify the email change. Shouldn't this go to [email protected]? Surely the current email address should receive the email with the confirmation link and not the new email address as this opens an opportunity for someone to take over an account.

Hope I explained this well enough.

 

[Agathocles Prodromou]

If you can change [email protected] to [email protected], then you already have full control of the account

 

[stephan23]

Yes but it is the rare situations where someone is trying to take over an account that isn't authorised to do so. There are many possible scenarios how this could happen.

For security purposes and to prevent anyone maliciously changing the email address I think that best practice would be

1. Ask for password before changing email address
2. Email the old email address to authorise the change
3. Email the new email address to verify that the new email address was entered correctly

Only once all 3 points are met should the email address be changed.

That is my opinion at least. Especially as loosing a phone system would be devastating for the business I am working for.

Anyway I brought this to your attention you can mark this as solved.