Lucene search

K
cve[email protected]CVE-2009-1077
HistoryOct 03, 2022 - 4:23 p.m.

CVE-2009-1077

2022-10-0316:23:57
CWE-264
web.nvd.nist.gov
23
change my password
sun java system identity manager
idm
security vulnerability
remote authentication
password change
nvd
cve-2009-1077

6.5 Medium

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.01 Low

EPSS

Percentile

83.8%

The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator’s password.

Affected configurations

NVD
Node
sunjava_system_identity_managerMatch7.0
OR
sunjava_system_identity_managerMatch7.1
OR
sunjava_system_identity_managerMatch7.1.1
OR
sunjava_system_identity_managerMatch8.0

6.5 Medium

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.01 Low

EPSS

Percentile

83.8%

Related for CVE-2009-1077