PT-2019-5531 · Ignite Realtime · Openfire

Alexandr Shvetsov · Publicado 2019-10-03 · Atualizado 2024-07-12 · CVE-2019-18394

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Openfire versions through 4.4.2

Description A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests, which can be exploited by a remote attacker.

Recommendations For versions through 4.4.2, update to version 4.5.0-beta or later to resolve the issue. As a temporary workaround, consider restricting access to the FaviconServlet.java function to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2020-03818

CVE-2019-18394

GHSA-MFJW-X4Q4-69P9

Produtos afetados

Openfire

Referências · 14

• https://github.com/igniterealtime/Openfire · Nota
• https://github.com/igniterealtime/Openfire/pull/1497 · Correção
• https://github.com/igniterealtime/Openfire/commit/c2ccb38250910587498597955d0bbee8b58e46df · Nota
• https://t.me/true_secator/5965 · Publicação no Telegram
• https://t.me/cibsecurity/39191 · Publicação no Telegram
• https://swarm.ptsecurity.com/openfire-admin-console · Nota
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18394&scoretype=cvssv2 · Nota
• https://t.me/aptreports/11046 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2020-03818 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mfjw-x4q4-69p9 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18394 · Nota de Segurança
• https://t.me/cybersecuritytechnologies/1539 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-18394 · Aviso do Fabricante
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18394&scoretype=cvssv2 · Nota