CVE-2009-1595

Published: May 11, 2009Modified: Apr 23, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.

Affected (29)

Products: Igniterealtime: Openfire

Igniterealtime

1 product

Openfire

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Igniterealtime Openfire	Up to 3.6.3
Igniterealtime Openfire	Version 2.6.0
Igniterealtime Openfire	Version 2.6.1
Igniterealtime Openfire	Version 2.6.2
Igniterealtime Openfire	Version 3.0.0
Igniterealtime Openfire	Version 3.0.1
Igniterealtime Openfire	Version 3.1.0
Igniterealtime Openfire	Version 3.1.1
Igniterealtime Openfire	Version 3.2.0
Igniterealtime Openfire	Version 3.2.1
Igniterealtime Openfire	Version 3.2.2
Igniterealtime Openfire	Version 3.2.3
Igniterealtime Openfire	Version 3.2.4
Igniterealtime Openfire	Version 3.3.0
Igniterealtime Openfire	Version 3.3.2
Igniterealtime Openfire	Version 3.3.3
Igniterealtime Openfire	Version 3.4.0
Igniterealtime Openfire	Version 3.4.1
Igniterealtime Openfire	Version 3.4.2
Igniterealtime Openfire	Version 3.4.3
Igniterealtime Openfire	Version 3.4.4
Igniterealtime Openfire	Version 3.4.5
Igniterealtime Openfire	Version 3.5.0
Igniterealtime Openfire	Version 3.5.1
Igniterealtime Openfire	Version 3.5.2
Igniterealtime Openfire	Version 3.6.0
Igniterealtime Openfire	Version 3.6.0a
Igniterealtime Openfire	Version 3.6.1
Igniterealtime Openfire	Version 3.6.2