CVE-2009-1077

The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge…

published March 25, 2009

CVSS
—
EPSS
2%
Percentile
84.4
In the wild
Unconfirmed
What it is

The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02475 · 84.4th percentile
Published
2009-03-25T15:00Z
EPSS history
Timeline
  • 25 MAR 15:00Z
    The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge…
    cvelistv5