Openfire Security Bypass Vulnerabilities

  1. Network Vulnerabilities
  2. Web application abuses
  3. Openfire Security Bypass Vulnerabilities
Impact
Successful exploitation will let the attacker change the passwords of arbitrary accounts via a modified username element in a passwd_change action or can bypass intended policy and change their own passwords via a passwd_change IQ packet. Impact Level: Application/Network Impact Level: Application/Network
Solution
Upgrade to Openfire 3.6.4 or later http://www.igniterealtime.org/projects/openfire ***** Note: Vulnerability is related to CVE-2009-1595 and CVE-2009-1596 *****
Affected
Openfire prior to 3.6.4
References
Updated on 2015-03-25
Severity
Medium Severity
Classification
Related Vulnerabilities