CVEvulnerability
CVE-2009-1596
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-05-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-287
Description
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.
Affected configurations
• igniterealtime openfire (< 3.6.5)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
Referenced by CWE · observed example (1)
- CWE-287 Improper Authentication weakness
References
- http://secunia.com/advisories/34984 Broken Link, Vendor Advisory
- http://www.igniterealtime.org/community/message/190280 Exploit, Issue Tracking, Patch, Vendor Advisory
- http://www.igniterealtime.org/issues/browse/JM-1532 Patch, Permissions Required, Vendor Advisory
- http://www.osvdb.org/54189 Broken Link
- http://www.securityfocus.com/bid/34804 Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50291 Third Party Advisory, VDB Entry
- http://secunia.com/advisories/34984 Broken Link, Vendor Advisory
- http://www.igniterealtime.org/community/message/190280 Exploit, Issue Tracking, Patch, Vendor Advisory
- http://www.igniterealtime.org/issues/browse/JM-1532 Patch, Permissions Required, Vendor Advisory
- http://www.osvdb.org/54189 Broken Link
- http://www.securityfocus.com/bid/34804 Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50291 Third Party Advisory, VDB Entry