PT-2019-5532 · Ignite Realtime · Openfire

Alexandr Shvetsov · Publicado 2019-10-03 · Atualizado 2022-05-24 · CVE-2019-18393

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Openfire versions 4.4.2 and earlier

Description The issue is related to a directory traversal vulnerability in the PluginServlet.java file. This vulnerability exists due to incorrect path name restrictions to a directory with limited access. Exploitation of the vulnerability may allow a remote attacker to impact the confidentiality of protected information.

Recommendations For Openfire versions 4.4.2 and earlier, update to version 4.5.0-beta or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories under the Openfire home directory to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2020-03826

CVE-2019-18393

GHSA-59H8-H34R-Q9CV

Produtos afetados

Openfire

Referências · 9

• https://github.com/igniterealtime/Openfire/pull/1498 · Correção
• https://github.com/igniterealtime/Openfire/commit/cb900749d4e836b32cc6e2cc41cda17f252b977d · Nota
• https://bdu.fstec.ru/vul/2020-03826 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-18393 · Nota de Segurança
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18393&scoretype=cvssv2 · Nota
• https://osv.dev/vulnerability/CVE-2019-18393 · Aviso do Fabricante
• https://swarm.ptsecurity.com/openfire-admin-console · Nota
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18393&scoretype=cvssv2 · Nota
• https://osv.dev/vulnerability/GHSA-59h8-h34r-q9cv · Aviso do Fabricante