CVE-2023-32315highunder attackCWE-22

CVE-2023-32315: high-severity vulnerability in igniterealtime Openfire

Openfire administration console authentication bypass

Published · Updated

Follow this CVE+ Monitor Openfire+ Monitor org.igniterealtime.openfire:xmppserver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.6epss 100%
from disclosure to weapon19 days
Published on NVDMay 26
1st PoC+19d
metasploitMay 26
CISA KEV+90d
Action required by CISAfederal deadline: 2023-09-14

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Openfire's web-based admin console can be accessed without authentication by exploiting a path traversal flaw in the setup page, even after the server is fully configured. An attacker can bypass login requirements and gain unauthorized administrative access.

Technical detail

A path traversal vulnerability in Openfire's unauthenticated setup environment allows an attacker to manipulate file paths and access restricted admin console pages without credentials. The attack requires network access to the web interface and affects all versions from 3.10.0 onwards; exploitation grants full administrative access to the XMPP server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected products
igniterealtime · Openfire
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — igniterealtime Openfire

In the same product, most dangerous first.

CVE-2020-36956MEDIUMOpenfire 4.6.0 - 'path' Stored XSSEPSS 0.3%CVE-2025-59154MEDIUMOpenfire allows potential identity spoofing via unsafe CN parsingEPSS 0.2%