PT-2019-5531 · Ignite Realtime · Openfire

Alexandr Shvetsov · Published 2019-10-03 · Updated 2024-07-12 · CVE-2019-18394

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Openfire versions through 4.4.2

Description A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests, which can be exploited by a remote attacker.

Recommendations For versions through 4.4.2, update to version 4.5.0-beta or later to resolve the issue. As a temporary workaround, consider restricting access to the FaviconServlet.java function to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2020-03818

CVE-2019-18394

GHSA-MFJW-X4Q4-69P9

Affected Products

Openfire

References · 14

• https://github.com/igniterealtime/Openfire/pull/1497 · Patch
• https://bdu.fstec.ru/vul/2020-03818 · Security Note
• https://osv.dev/vulnerability/GHSA-mfjw-x4q4-69p9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18394 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18394 · Vendor Advisory
• https://github.com/igniterealtime/Openfire · Note
• https://github.com/igniterealtime/Openfire/commit/c2ccb38250910587498597955d0bbee8b58e46df · Note
• https://t.me/true_secator/5965 · Telegram Post
• https://t.me/cibsecurity/39191 · Telegram Post
• https://swarm.ptsecurity.com/openfire-admin-console · Note
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18394&scoretype=cvssv2 · Note
• https://t.me/aptreports/11046 · Telegram Post
• https://t.me/cybersecuritytechnologies/1539 · Telegram Post
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18394&scoretype=cvssv2 · Note