Vulnerabilities > CVE-2019-18394 - Server-Side Request Forgery (SSRF) vulnerability in Igniterealtime Openfire

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
igniterealtime
CWE-918
NVD
Published: 2019-10-24
Updated: 2020-08-07

Summary

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

Vulnerable Configurations

Part Description Count
Application
Igniterealtime
57

Common Weakness Enumeration (CWE)

References