My partner was testing a web application and he found a XSS vulnerability on a change password module, this module places the old password in a hidden field, then it's possible to use a XSS attack to change a password of a user, because the old password can be got by XSS exploit. Also this module doesn't use a token or CAPTCHA to ensure if a request is valid, then my question is: could this vulnerability be consired as CSRF? Why?
I'm not sure because if I mitigate XSS vulnerability and change the hidden field by text field to ensure users introduce their old password a CSRF could'nt be exploited. My partner told me that it could be considered a CSRF because althought we don't know the old password, the web application doesn't use a token or CAPTCHA so we can change a password using brute force and this a kind of CSRF. Is this correct?