CVE-2023-32315
Ignite Realtime Openfire Path Traversal Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 14 September 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 100.00% probability · 100th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 24 August 2023 · due 14 September 2023
- Weakness
- CWE-22
- Affected
- igniterealtime/openfire
- Source
- security-advisories@github.com
EPSS 100.0% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.igniterealtime.org/downloads/#openfire; https://nvd.nist.gov/vuln/detail/CVE-2023-32315
References
- http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvmExploit, Mitigation, Patch, Vendor Advisory
- http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvmExploit, Mitigation, Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32315US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.