CVE-2009-1595
Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
Exploit likelihood
What each source reports
NVD Score used
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
- Record
CVE-2009-1595- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
- Record
CVE-2009-1595- Updated
- 2026-11-02
EUVDEUVD-2022-5104 No score
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
- Record
EUVD-2022-5104- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r62w-x9pp-jrqp No score
Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
- Record
GHSA-r62w-x9pp-jrqp- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-r62w-x9pp-jrqp No score
Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
- Record
GHSA-r62w-x9pp-jrqp- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.igniterealtime.openfire:parentMaven |
before 3.6.4 | 3.6.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Openfire 3.x - jabber:iq:auth 'passwd_change' Remote Password Change | 2009-05-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1595 is a medium vulnerability (CVSS 4.0) in Igniterealtime Openfire, published May 11, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. Fixed in org.igniterealtime.openfire:parent 3.6.4.
References
vupen.com/english/advisories/2009/1237
igniterealtime.org/builds/openfire/docs/latest/changelog.html
osvdb.org/54189
securityfocus.com/bid/34804
Show 9 moreShow less
secunia.com/advisories/34976
exchange.xforce.ibmcloud.com/vulnerabilities/50292
nvd.nist.gov/vuln/detail/CVE-2009-1595
github.com/igniterealtime/Openfire/commit/97e1f08cf72e430f5cca5ba94cd20703dadb5ce5
download.igniterealtime.org/openfire/docs/latest/changelog.html
web.archive.org/web/20090518061336/http://www.igniterealtime.org/issues/browse/JM-1531