Java System Identity Manager

Vendor:

First CVE: Jan 11, 2008 · Active for 18 years

19

Total CVEs

More Total CVEs than 93% of tracked products

9.5

Avg CVEs / Year

Higher CVE frequency than 95% of tracked products

5.6

Avg CVSS

Higher Avg CVSS than 16% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Java System Identity Manager over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jan 11, 2008

18 years ago

Most Recent CVE

Mar 25, 2009

6,330 days ago

CVE Severity & Scoring

Java System Identity Manager19 CVEs

84%

16%

All CVEs352,294 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown19 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown19 (100.0%)

User Interaction

None0 (0.0%)

Unknown19 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown19 (100.0%)

Top CVEs

Signals from CVEs in this product scope (19 CVEs).

19 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2008-5115MEDIUM Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of admini	Nov 18, 2008	6.8	27	NO	YES
CVE-2009-1083HIGH Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attacke	Mar 25, 2009	9.0	23	NO	NO
CVE-2009-1082HIGH Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by	Mar 25, 2009	9.0	23	NO	NO
CVE-2008-0239MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web scr	Jan 11, 2008	4.3	23	NO	YES
CVE-2008-0240MEDIUM /idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing att	Jan 11, 2008	4.3	23	NO	YES
CVE-2008-5116HIGH Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary fil	Nov 18, 2008	7.8	21	NO	NO
CVE-2009-1084MEDIUM Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and po	Mar 25, 2009	6.4	18	NO	NO
CVE-2009-1077MEDIUM The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, whic	Mar 25, 2009	6.5	18	NO	NO
CVE-2008-5117MEDIUM Open redirect vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phish	Nov 18, 2008	6.4	18	NO	NO
CVE-2008-0241MEDIUM Open redirect vulnerability in /idm/user/login.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web	Jan 11, 2008	5.8	18	NO	NO

View all 19 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (19 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

3 CVEs

15.8% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (19 CVEs).

Media Mentions

Signals from CVEs in this product scope (19 CVEs).

Top CNAs Publishing CVEs For Java System Identity Manager

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
8.0	11	5.7	2.5%	0
7.1.1	11	5.7	2.5%	0
7.1	19	5.6	2.9%	3
7.0	19	5.6	2.9%	3
6.0	8	5.6	3.3%	3