CVE-2009-1077
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other…
Does this matter?
Lower severity and a low EPSS score (2.48%). Track it; it rarely justifies an emergency change on its own.
Description
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 2.48% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- sun/java system identity manager
- Source
- cve@mitre.org
References
- http://blogs.sun.com/security/entry/sun_alert_253267_sun_javaPatch, Vendor Advisory
- http://secunia.com/advisories/34380Vendor Advisory
- http://securitytracker.com/id?1021881
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1Patch, Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1Patch, Vendor Advisory
- http://www.securityfocus.com/bid/34191Exploit, Patch
- http://www.vupen.com/english/advisories/2009/0797Vendor Advisory
- http://blogs.sun.com/security/entry/sun_alert_253267_sun_javaPatch, Vendor Advisory
- http://secunia.com/advisories/34380Vendor Advisory
- http://securitytracker.com/id?1021881
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1Patch, Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1Patch, Vendor Advisory
- http://www.securityfocus.com/bid/34191Exploit, Patch
- http://www.vupen.com/english/advisories/2009/0797Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.