| Package | Affected versions | Patched versions |
|---|---|---|
| java system identity manager | = 7.0= 7.1= 7.1.1= 8.0 |
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free