Ignite Realtime Openfire vulnerable to Server Side Request Forgery

CRITICAL 9.8CVE-2019-18394 · GHSA-mfjw-x4q4-69p9 · Published 24/10/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.igniterealtime.openfire:parent Maven	`< 4.5.0-beta`	`4.5.0-beta`
openfire igniterealtime	`≤ 4.4.2`	No fix yet

Description

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. The issue is fixed in version 4.5.0-beta.

NVD description

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

References

nvd.nist.gov/vuln/detail/CVE-2019-18394 · ADVISORY
igniterealtime/Openfire#1497 · WEB
igniterealtime/Openfire commit c2ccb38 · WEB
igniterealtime/Openfire · PACKAGE
swarm.ptsecurity.com/openfire-admin-console · WEB
swarm.ptsecurity.com/openfire-admin-console

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free