Threat database

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.

CVE-2023-32315 is a high-severity path traversal vulnerability in the Openfire XMPP server's administrative console setup environment. It allows unauthenticated attackers to access restricted administrative pages by exploiting improper pathname restrictions. This affects all Openfire versions released since April 2015 up to versions before 4.6.8 and 4.7.5, with patches available in those versions. The vulnerability enables attackers to gain partial administrative access without credentials, potentially compromising confidentiality and availability. No known exploits are currently in the wild, but the ease of exploitation and broad version impact make timely patching critical. European organizations using Openfire should prioritize upgrading to patched versions or apply mitigations from the GitHub advisory.