| Package | Affected versions | Patched versions |
|---|---|---|
| org.igniterealtime.openfire:parent | < 4.5.0-beta | 4.5.0-beta |
| openfire | ≤ 4.4.2 |
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. Version 4.5.0-beta contains a fix for the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free