Ignite Realtime Openfire directory traversal vulnerability

MEDIUM 5.3CVE-2019-18393 · GHSA-59h8-h34r-q9cv · Published 24/10/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.igniterealtime.openfire:parent Maven	`< 4.5.0-beta`	`4.5.0-beta`
openfire igniterealtime	`≤ 4.4.2`	No fix yet

Description

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. Version 4.5.0-beta contains a fix for the issue.

NVD description

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2019-18393 · ADVISORY
igniterealtime/Openfire#1498 · WEB
igniterealtime/Openfire commit cb90074 · WEB
swarm.ptsecurity.com/openfire-admin-console · WEB
swarm.ptsecurity.com/openfire-admin-console

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free