CVE-2009-1596

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-11 · updated 2026-06-16
Weakness: CWE-287

Description

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.

Affected products

igniterealtime Openfire: before 3.6.5 — fixed in 3.6.5

How to fix

Upgrade to a fixed version: igniterealtime Openfire 3.6.5. Check the vendor advisory for mitigations.

References

http://secunia.com/advisories/34984
http://www.igniterealtime.org/community/message/190280
http://www.igniterealtime.org/issues/browse/JM-1532
http://www.osvdb.org/54189
http://www.securityfocus.com/bid/34804
https://exchange.xforce.ibmcloud.com/vulnerabilities/50291
http://secunia.com/advisories/34984
http://www.igniterealtime.org/community/message/190280
http://www.igniterealtime.org/issues/browse/JM-1532
http://www.osvdb.org/54189
http://www.securityfocus.com/bid/34804
https://exchange.xforce.ibmcloud.com/vulnerabilities/50291

Get alerted when CVE-2009-1596 or the next vulnerability affects your stack