CVE-2009-1077

published 2009-03-25

CVE-2009-1077: The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge…

medium 6.5 CVSS 3.1

AV N AC L Au S C P I P A P

The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sun	java_system_identity_manager	—	—
sun	java_system_identity_manager	—	—
sun	java_system_identity_manager	—	—
sun	java_system_identity_manager	—	—

CWE-264