Openfire Security Vulnerabilities and Issues — Openfire CVE List

Lucene search

IgniterealtimeOpenfire

2 matches found

CVE•added 2019/10/24 11:15 a.m.•201 views

CVE-2019-18394

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

9.8CVSS8.5AI score0.94046EPSS

CVE•added 2019/10/24 11:15 a.m.•83 views

CVE-2019-18393

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

5.3CVSS5.5AI score0.82213EPSS