Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-1595 | First vendor Publication | 2009-05-11 |
| Vendor | Cve | Last vendor Modification | 2017-08-17 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1595 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-287 | Improper Authentication |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-05-18 | Name : Openfire Security Bypass Vulnerabilities File : nvt/gb_openfire_sec_bypass_vuln_may09.nasl |
| 2008-11-24 | Name : FreeBSD Ports: openfire File : nvt/freebsd_openfire0.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54189 | Openfire IQAuthHandler.java jabber:iq:auth Crafted passwd_change Request Arbi... Openfire contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered when the 'no password changes' setting is not properly respected by Openfire. It is possible that the flaw may allow a malicious user to change other users' passwords by sending jabber:iq:auth passwd_change requests to the server resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-07-01 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201406-35.nasl - Type : ACT_GATHER_INFO |
| 2009-05-05 | Name : The remote host contains an application that is affected by a remote password... File : openfire_3_6_4.nasl - Type : ACT_GATHER_INFO |
| 2008-11-21 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_937adf01b64a11dda55e00163e000016.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-05 01:05:55 |
|
| 2021-05-04 12:09:32 |
|
| 2021-04-22 01:09:53 |
|
| 2020-05-24 01:05:44 |
|
| 2020-05-23 01:40:23 |
|
| 2020-05-23 00:23:44 |
|
| 2019-08-27 12:03:01 |
|
| 2017-08-17 09:22:34 |
|
| 2016-06-28 17:41:16 |
|
| 2016-04-26 18:48:47 |
|
| 2014-07-02 13:25:50 |
|
| 2014-02-17 10:49:58 |
|
| 2013-05-10 23:50:02 |
|
