Password Change Vulnerability in Sun Java System Identity Manager by Sun Microsystems

CVE-2009-1077

Summary

The Change My Password feature in the admin interface of Sun Java System Identity Manager versions 7.0 and 8.0 lacks proper enforcement of the RequiresChallenge property setting. This oversight permits remote authenticated users to change passwords of other accounts without required verifications. An example highlighted is the ability to change an administrator's password, posing a significant security threat and potential for abuse if exploited.

References