Authentication Bypass

org.igniterealtime.openfire:xmppserver is vulnerable to authentication bypass. A remote unauthenticated attacker is able to access restricted pages in the Openfire Admin Console designated for administrative users due to a path traversal in the unauthenticated Openfire Setup Environment...

Directory Traversal

xmppserver is vulnerable to directory traversal. Lack of validation of file names in the handleOtherRequest function in PluginServlet.java allows an attacker to retrieve local system files...