The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-03-25T15:00:00Z

Updated: 2024-09-16T20:22:35.692Z

Reserved: 2009-03-25T00:00:00Z

Link: CVE-2009-1077

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2009-03-25T15:30:00.327

Modified: 2009-10-06T04:00:00.000

Link: CVE-2009-1077

cve-icon Redhat

No data.