CVE-2023-32315

🗓️ 26 May 2023 22:33:07Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 587 Views🌐 WEB

Openfire XMPP server admin console path traversal vulnerabilit

Reporter	Title	Published	Views	Family All 48
0day.today	Openfire Authentication Bypass / Remote Code Execution Exploit	19 Jul 202300:00	–	zdt
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	7 Jul 202307:48	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	15 Dec 202316:30	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	14 Apr 202518:07	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	2 Jul 202320:38	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	18 Jun 202315:42	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	30 Jan 202517:47	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	2 Jul 202320:38	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	4 Sep 202512:53	–	githubexploit
GithubExploit	Exploit for Path Traversal in Igniterealtime Openfire	2 Jul 202320:38	–	githubexploit

NVD

Vulners

Node

igniterealtime openfireRange3.10.0–4.6.8

igniterealtime openfireRange4.7.0–4.7.5

[
  {
    "vendor": "igniterealtime",
    "product": "Openfire",
    "versions": [
      {
        "version": ">= 3.10.0, < 4.6.8",
        "status": "affected"
      },
      {
        "version": ">= 4.7.0, < 4.7.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm
packetstormsecurity	www.packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
csrf	path	/setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp	Path traversal to create a new admin user via setup environment; subsequent login used to gain admin access.	CWE-22
username	path	/setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp	Path traversal to create a new admin user via setup environment; subsequent login used to gain admin access.	CWE-22
password	path	/setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp	Path traversal to create a new admin user via setup environment; subsequent login used to gain admin access.	CWE-22
passwordConfirm	path	/setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp	Path traversal to create a new admin user via setup environment; subsequent login used to gain admin access.	CWE-22
isadmin	path	/setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp	Path traversal to create a new admin user via setup environment; subsequent login used to gain admin access.	CWE-22
create	path	/setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp	Path traversal to create a new admin user via setup environment; subsequent login used to gain admin access.	CWE-22

24 Oct 2025 14:02Current

8.2High risk

Vulners AI Score8.2

CVSS 3.17.5 - 8.6

EPSS0.94441

SSVC