source: https://www.securityfocus.com/bid/32262/info Sun Java System Identity Manager is prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, multiple cross-site scripting issues, multiple HTML-injection issues, and a directory-traversal vulnerability. Successful exploits of many of these issues will allow an attacker to completely compromise the affected application. These issues affect the following versions: Sun Java System Identity Manager 6.0 Sun Java System Identity Manager 6.0 SP1 Sun Java System Identity Manager 6.0 SP2 Sun Java System Identity Manager 6.0 SP3 Sun Java System Identity Manager 6.0 SP4 Sun Java System Identity Manager 7.0 Sun Java System Identity Manager 7.1

CSRF attack demo - changes administrative password to 'Password19'