CVE-2009-1595

The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.4.2:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.4.3:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.4.4:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.4.5:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.5.1:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.6.0a:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.6.1:*:*:*:*:*:*:*
cpe:2.3:a:igniterealtime:openfire:3.6.2:*:*:*:*:*:*:*

History

No history.

Information

Published : 2009-05-11 14:30

Updated : 2024-02-04 17:33


NVD link : CVE-2009-1595

Mitre link : CVE-2009-1595

CVE.ORG link : CVE-2009-1595


JSON object : View

Products Affected

igniterealtime

  • openfire
CWE
CWE-287

Improper Authentication