Medium severity · published May 11, 2009
CVE-2009-1596
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated…
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openfire · Igniterealtime
before 3.6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1596
Broken Link
http://secunia.com/advisories/34984
Exploit
http://www.igniterealtime.org/community/message/190280
Patch
http://www.igniterealtime.org/issues/browse/JM-1532
Broken Link
http://www.osvdb.org/54189
Broken Link
http://www.securityfocus.com/bid/34804
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50291
More from Openfire
7.5
CVE-2023-32315
Openfire administration console authentication bypass
9.8
CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component
9.8
CVE-2021-45967
An issue was discovered in Pascom Cloud Phone System before 7.20.x
9.8
CVE-2019-18394
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests
7.5
CVE-2014-3451
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks