CVE-2009-1596: igniterealtime openfire Improper Authentication
Vulnerability summary
CVE-2009-1596 is a medium (CVSS 6.5) Improper Authentication vulnerability in igniterealtime openfire. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 11-05-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.20% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (igniterealtime.org)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Igniterealtime1 product
- openfire< 3.6.5
1 vendor · 1 product
References
6 links- www.igniterealtime.org/community/message/190280X Refsource CONFIRMExploitIssue TrackingPatchVendor Advisory
- www.igniterealtime.org/issues/browse/JM-1532X Refsource CONFIRMPatchPermissions RequiredVendor Advisory