CVE-2009-1082

EUVD-2009-1083
Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and other administrative capabilities, related to the saveNoValidate action and saveNoValidateAllowedFormsAndWorkflows IDs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
sunjava_system_identity_manager
7.0
sunjava_system_identity_manager
7.1
sunjava_system_identity_manager
7.1.1
sunjava_system_identity_manager
8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
http://secunia.com/advisories/34380
http://securitytracker.com/id?1021881
http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
http://www.securityfocus.com/bid/34191
http://www.vupen.com/english/advisories/2009/0797
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
http://secunia.com/advisories/34380
http://securitytracker.com/id?1021881
http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
http://www.securityfocus.com/bid/34191
http://www.vupen.com/english/advisories/2009/0797