Ignite Realtime Openfire vulnerable to Server Side Request Forgery

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-18394 · ADVISORY
• igniterealtime/Openfire#1497 · WEB
• igniterealtime/Openfire commit c2ccb38 · WEB
• igniterealtime/Openfire · PACKAGE
• swarm.ptsecurity.com/openfire-admin-console · WEB
• swarm.ptsecurity.com/openfire-admin-console

Weitere Schwachstellen in org.igniterealtime.openfire:parent

• CVE-2019-20526MITTEL 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
• CVE-2019-20525MITTEL 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
• CVE-2019-20527MITTEL 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
• CVE-2019-20366MITTEL 6.1An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
• CVE-2019-18393MITTEL 5.3PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct…