CVE-2009-1075 - Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames

Back Back to CVE browser

MEDIUM

Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames

Published Mar 25, 2009

5.0

MEDIUM

CVSS 2.0

EPSS 2.46%

Description

Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-255

References (7)

http://blogs.sun.com/security/entry/sun_alert_253267_sun_java
x_refsource_CONFIRMPatchVendor Advisory
http://secunia.com/advisories/34380
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securitytracker.com/id?1021881
vdb-entryx_refsource_SECTRACK
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1
x_refsource_CONFIRMPatch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1
vendor-advisoryx_refsource_SUNALERTPatchVendor Advisory
http://www.securityfocus.com/bid/34191
vdb-entryx_refsource_BIDExploitPatch
http://www.vupen.com/english/advisories/2009/0797
vdb-entryx_refsource_VUPENVendor Advisory

Link	Providers	Tags
http://blogs.sun.com/security/entry/sun_alert_253267_sun_java		x_refsource_CONFIRMPatchVendor Advisory
http://secunia.com/advisories/34380		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securitytracker.com/id?1021881		vdb-entryx_refsource_SECTRACK
http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1		x_refsource_CONFIRMPatch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1		vendor-advisoryx_refsource_SUNALERTPatchVendor Advisory
http://www.securityfocus.com/bid/34191		vdb-entryx_refsource_BIDExploitPatch
http://www.vupen.com/english/advisories/2009/0797		vdb-entryx_refsource_VUPENVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Mar 25, 2009

Updated Sep 17, 2024

Reserved Mar 25, 2009

Link CVE-2009-1075

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-1075

Red Hat

Severity n/a

Public date n/a

Links CVE-2009-1075