CVE-2009-1075: Medium severity Sun Java System Identity Manager vulnerability
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1075?
CVE-2009-1075 has a medium severity rating due to its potential for user enumeration vulnerabilities.
How does CVE-2009-1075 affect user accounts?
CVE-2009-1075 allows attackers to distinguish between valid and invalid usernames based on the response from the Forgot Password feature.
Which versions of Sun Java System Identity Manager are affected by CVE-2009-1075?
CVE-2009-1075 affects Sun Java System Identity Manager versions 7.0 through 8.0.
How can I fix CVE-2009-1075?
To fix CVE-2009-1075, upgrade to a patched version of Sun Java System Identity Manager that mitigates the enumeration flaw.
What is the impact of exploiting CVE-2009-1075?
Exploitation of CVE-2009-1075 can lead to an increased risk of attacks such as password guessing and account enumeration.