CVE-2009-1596: Medium severity igniterealtime Openfire vulnerability
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwdchange IQ packet.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1596?
The severity of CVE-2009-1596 is classified as Medium due to the potential for unauthorized password changes by authenticated users.
How do I fix CVE-2009-1596?
To fix CVE-2009-1596, upgrade Openfire to version 3.6.5 or later.
Who is affected by CVE-2009-1596?
Openfire versions prior to 3.6.5, including 2.6.0 to 3.6.4, are affected by CVE-2009-1596.
What are the implications of CVE-2009-1596?
CVE-2009-1596 allows authenticated users to change their own passwords, which can lead to unauthorized access and account compromise.
How does CVE-2009-1596 exploit the Openfire configuration?
CVE-2009-1596 exploits a misconfiguration of the register.password setting, allowing bypass of intended password policies.