Skip to content

Ignite Realtime Openfire Path Traversal Vulnerability added to CISA Known Exploited Catalog - 20230829002

Overview

CISA has added CVE-2023-32315 to their Known Exploited Vulnerability Catalog.

Openfire's administrative console (the Admin Console), a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.

What is the vulnerability?

CVE-2023-32315: CVSS v3 Base Score: 7.5

  • An important security issue affects a range of versions of Openfire, the cross-platform real-time collaboration server based on the XMPP protocol that is created by the Ignite Realtime community.

What is vulnerable?

This vulnerability affects all versions of Openfire that have been released since April 2015, including the following versions:

  • 3.10.0, 3.10.1, 3.10.2, 3.10.3
  • 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4
  • 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6
  • 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4
  • 4.3.0, 4.3.1, 4.3.2
  • 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4
  • 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6
  • 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, 4.6.6, 4.6.7
  • 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4

What has been observed?

CISA added this vulnerabilty in their Known Exploited Vulnerabilties catalog. There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.

Recommendation

The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of two weeks... (refer Patch Management):