GitHub Advisoryadvisory · Maven

GHSA-r62w-x9pp-jrqp Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts

MEDIUM Published 2022-05-02 Modified 2024-01-23 Official page ↗
Aliases
CVE-2009-1595
Ecosystem
Maven
Packages
org.igniterealtime.openfire:parent
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2024-01-23

Affected packages

• Maven org.igniterealtime.openfire:parent: < 3.6.4 → fixed in 3.6.4

Description

The `jabber:iq:auth` implementation in `IQAuthHandler.java` in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a `passwd_change` action.

Related

Alias · CVE (1)

  • CVE-2009-1595 The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References