GitHub Advisory DatabaseGHSA-6PWG-GG6J-5CRM

HistoryMar 26, 2024 - 9:30 p.m.

Ignite Realtime Openfire privilege escalation vulnerability

2024-03-2621:30:47

CWE-863

GitHub Advisory Database

github.com

ignite realtime

openfire

privilege escalation

vulnerability

room_cache

software

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.

Affected configurations

Vulners

Node

github_advisory_databaseorg.igniterealtime.openfire\Matchxmppserver

CPENameOperatorVersion
org.igniterealtime.openfire:xmppserverlt4.8.1

CPE	Name	Operator	Version
	org.igniterealtime.openfire:xmppserver	lt	4.8.1

github.com/advisories/GHSA-6pwg-gg6j-5crm

github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/muc/spi/LocalMUCRoomManager.java

github.com/igniterealtime/Openfire/commit/d66bddd29dbf56aa9b822635619fa66cca6f2112

nvd.nist.gov/vuln/detail/CVE-2024-25421

www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421

www.igniterealtime.org/projects/openfire