Ignite Realtime Openfire Server-Side Request Forgery Vulnerability

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A server-side request forgery SSRF vulnerability exists in FaviconServlet.java in Ignite Realtime Openfire 4.4.2 and earlier versions. An attacker can exploit this vulnerability to send...

PT-2019-5531 · Ignite Realtime · Openfire

Name of the Vulnerable Software and Affected Versions: Openfire versions through 4.4.2 Description: A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests,...