CVE-2009-1596

6.5 mediumEPSS 1.2%

Medium (6.5) in igniterealtime openfire. EPSS 1.2% chance of exploitation in the next 30 days.

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2009-05-11
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

igniterealtime:openfire

References

http://secunia.com/advisories/34984
http://www.igniterealtime.org/community/message/190280
http://www.igniterealtime.org/issues/browse/JM-1532
http://www.osvdb.org/54189
http://www.securityfocus.com/bid/34804

Check your stack JSON