CVE-2009-1077

Currently unrated

Key Information:

Vendor
Oracle
Status
Java System Identity Manager
Vendor
CVE Published:
25 March 2009

Summary

The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.

References

http://sunsolve.sun.com/search/document.do?assetkey=1-21-...
x_refsource_CONFIRM
http://sunsolve.sun.com/search/document.do?assetkey=1-66-...
vendor-advisoryx_refsource_SUNALERT
http://sunsolve.sun.com/search/document.do?assetkey=1-21-...
x_refsource_CONFIRM

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.