← Database

CVE-2009-1595

MEDIUM CVSS: 4.0 Published: 2009-05-11 Modified: 2026-06-16

Description

The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.

Affected Platforms

Igniterealtime Openfire

Weakness Type

CWE-287

References