Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2023-32315

Openfire administration console authentication bypass
Back to all
CVE

CVE-2023-32315

Openfire administration console authentication bypass

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
8.6
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
C
H
U
-

Related Resources

No items found.

References

http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32315.json, https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm, https://nvd.nist.gov/vuln/detail/CVE-2023-32315, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32315

Severity

8.6

CVSS Score
0
10

Basic Information

Ecosystem
Base CVSS
8.6
EPSS Probability
0.94441%
EPSS Percentile
0.99989%
Introduced Version
6e4a0edb62d73db6350c25a19e157eb8b9ecc6a5,e020f58943742b0be541bafd30808d587867712b,0
Fix Available
db7e786abbc8456ff27e20fe92a8481e48b338c5,ee4395e4bc7fffc372060c916e9c143da0466984,4.7.5-r0

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading