PT-2019-5532 · Ignite Realtime · Openfire

Alexandr Shvetsov · Published 2019-10-03 · Updated 2022-05-24 · CVE-2019-18393

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Openfire versions 4.4.2 and earlier

Description The issue is related to a directory traversal vulnerability in the PluginServlet.java file. This vulnerability exists due to incorrect path name restrictions to a directory with limited access. Exploitation of the vulnerability may allow a remote attacker to impact the confidentiality of protected information.

Recommendations For Openfire versions 4.4.2 and earlier, update to version 4.5.0-beta or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories under the Openfire home directory to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-03826

CVE-2019-18393

GHSA-59H8-H34R-Q9CV

Affected Products

Openfire

References · 9

• https://github.com/igniterealtime/Openfire/pull/1498 · Patch
• https://bdu.fstec.ru/vul/2020-03826 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-18393 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18393 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59h8-h34r-q9cv · Vendor Advisory
• https://github.com/igniterealtime/Openfire/commit/cb900749d4e836b32cc6e2cc41cda17f252b977d · Note
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18393&scoretype=cvssv2 · Note
• https://swarm.ptsecurity.com/openfire-admin-console · Note
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-18393&scoretype=cvssv2 · Note