CVE-2009-1077

The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
VendorProductVersion
sunjava_system_identity_manager
7.0
sunjava_system_identity_manager
7.1
sunjava_system_identity_manager
7.1.1
sunjava_system_identity_manager
8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
http://secunia.com/advisories/34380
http://securitytracker.com/id?1021881
http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
http://www.securityfocus.com/bid/34191
http://www.vupen.com/english/advisories/2009/0797
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
http://secunia.com/advisories/34380
http://securitytracker.com/id?1021881
http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
http://www.securityfocus.com/bid/34191
http://www.vupen.com/english/advisories/2009/0797