CVE-2019-18393 - PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability

Back Back to CVE browser

MEDIUM

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability

Published Oct 24, 2019

5.3

MEDIUM

CVSS 3.1

EPSS 13.94%

Description

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2551
Advisory
https://github.com/advisories/GHSA-59h8-h34r-q9cv
Advisory
https://github.com/igniterealtime/Openfire/commit/cb900749d4e836b32cc6e2cc41cda17f252b977d
https://github.com/igniterealtime/Openfire/pull/1498
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18393
https://swarm.ptsecurity.com/openfire-admin-console/
x_refsource_MISC

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2551		Advisory
https://github.com/advisories/GHSA-59h8-h34r-q9cv		Advisory
https://github.com/igniterealtime/Openfire/commit/cb900749d4e836b32cc6e2cc41cda17f252b977d
https://github.com/igniterealtime/Openfire/pull/1498		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18393
https://swarm.ptsecurity.com/openfire-admin-console/		x_refsource_MISC