Login Request a demo
Unscored severity · published Mar 25, 2009
CVE-2009-1077
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting,…
–
CVSS
2.5%
EPSS
No
On KEV
Description
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java System Identity Manager · Sun
7.0; 7.1; 7.1.1; 8.0 · source: NVD
Affected product
JS
Java System Identity Manager
Sun
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1077
Patch
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
Vendor Advisory
http://secunia.com/advisories/34380
securitytracker.com
http://securitytracker.com/id?1021881
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
More from Java System Identity Manager
–
CVE-2009-1084
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and…
–
CVE-2009-1083
Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote…
–
CVE-2009-1082
Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by…
–
CVE-2009-1081
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via…
–
CVE-2009-1080
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via…