CVE-2009-1077

Published Mar 25, 2009

Last updated 15 years ago

Overview

Description: The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-264

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sun:java_system_identity_manager:7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0980492E-B7DB-4B9F-A400-FDC47DB89A95"
          },
          {
            "criteria": "cpe:2.3:a:sun:java_system_identity_manager:7.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A5C87C0-3734-4568-97A6-6AB8979AABE7"
          },
          {
            "criteria": "cpe:2.3:a:sun:java_system_identity_manager:7.1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E1E3B2F0-90E6-4868-915F-87131711EEE5"
          },
          {
            "criteria": "cpe:2.3:a:sun:java_system_identity_manager:8.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "90BC0B23-0CEE-489B-B89A-8776272EC8D2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References