CVE-2019-18394 - A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests

Back Back to CVE browser

CRITICAL

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests

Published Oct 24, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 32.30%

Description

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (5)

https://github.com/advisories/GHSA-mfjw-x4q4-69p9
Advisory
https://github.com/igniterealtime/Openfire/commit/c2ccb38250910587498597955d0bbee8b58e46df
https://github.com/igniterealtime/Openfire/pull/1497
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18394
https://swarm.ptsecurity.com/openfire-admin-console/
x_refsource_MISC

Link	Providers	Tags
https://github.com/advisories/GHSA-mfjw-x4q4-69p9		Advisory
https://github.com/igniterealtime/Openfire/commit/c2ccb38250910587498597955d0bbee8b58e46df
https://github.com/igniterealtime/Openfire/pull/1497		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18394
https://swarm.ptsecurity.com/openfire-admin-console/		x_refsource_MISC