Ignite Realtime Openfire vulnerable to XMPPbomb attack

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2014-2741 · ADVISORY
• igniterealtime/Openfire commit 3aec383 · WEB
• igniterealtime/Openfire · PACKAGE
• web.archive.org/web/20140407092132/http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · WEB
• web.archive.org/web/20140705161237/http://fisheye.igniterealtime.org/changelog/openfiregit · WEB
• community.igniterealtime.org/thread/52317 · WEB
• openwall.com/lists/oss-security/2014/04/07/7 · WEB
• openwall.com/lists/oss-security/2014/04/09/1 · WEB
• kb.cert.org/vuls/id/495476 · WEB
• fisheye.igniterealtime.org/changelog/openfiregit

org.igniterealtime.openfire:parent のその他の脆弱性

• CVE-2019-20526中 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
• CVE-2019-20525中 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
• CVE-2019-20527中 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
• CVE-2019-20366中 6.1An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
• CVE-2019-18394緊急 9.8A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send…