PT-2007-4272 · Ignite Realtime · Ignite Realtime Openfire

Published 2007-06-01 · Updated 2008-09-10 · CVE-2007-2975

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire versions 3.3.0 and earlier

Description The issue is related to the admin console in Ignite Realtime Openfire, where a filter mapping in web.xml is not properly specified. This allows remote attackers to gain privileges and execute arbitrary code by accessing functionality exposed through DWR.

Recommendations For versions 3.3.0 and earlier, consider restricting access to the admin console and DWR functionality until a proper fix is applied. As a temporary workaround, disabling DWR or limiting its exposure can help minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-2975

Affected Products

Ignite Realtime Openfire

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-2975 · Security Note
• http://igniterealtime.org/issues/browse/JM-1049 · Vendor Advisory
• http://securityfocus.com/bid/24205 · Patch
• http://secunia.com/advisories/25427 · Vendor Advisory
• http://osvdb.org/36713 · Note
• http://blogs.reucon.com/srt/2007/05/11/openfire_3_3_1_fixes_critical_security_issue.html · Note