ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated…
Priority LOW 22CWE-399Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-399 and the CVSS impact.
Summary
ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.
Why it matters now
EPSS 0.01657 76th percentileScored 2026-11-07
Fix Fixed org.igniterealtime.openfire:parent (Maven): 3.5.0org.igniterealtime.openfire:openfire (Maven): 3.5.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.igniterealtime.openfire:parent (Maven) | before 3.5.0 | 3.5.0 | Patch available | GHSA-x337-43mr-gg3h |
| — | org.igniterealtime.openfire:openfire (Maven) | before 3.5.0 | 3.5.0 | Patch available | GHSA-x337-43mr-gg3h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.igniterealtime.openfire:parent (Maven) Vendor— Affected before 3.5.0 Fixed in 3.5.0 Patch available GHSA-x337-43mr-gg3h
- org.igniterealtime.openfire:openfire (Maven) Vendor— Affected before 3.5.0 Fixed in 3.5.0 Patch available GHSA-x337-43mr-gg3h
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ignite_realtime:openfire:3.4.5:*:*:*:*:*:*:* | 3.4.5 | Vulnerable | Ignite Realtime |
- cpe:2.3:a:ignite_realtime:openfire:3.4.5:*:*:*:*:*:*:* Versions 3.4.5 Vulnerable ·Ignite Realtime
Remediation
- Fix · GHSA-x337-43mr-gg3h org.igniterealtime.openfire:parent (Maven) Fixed in 3.5.0 Advisory →
- Fix · GHSA-x337-43mr-gg3h org.igniterealtime.openfire:openfire (Maven) Fixed in 3.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2008-1728
- 2026-10-03 Alias added: GHSA-x337-43mr-gg3h
References
Advisory 3
Other 9
- ADV-2008-1188
- http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
- http://www.igniterealtime.org/fisheye/changelog/svn-org?cs=10031
- [oss-security] 20080411 CVE request: openfire <3.5.0 Denial of Service
- https://github.com/igniterealtime/Openfire/commit/c9cd1e521673ef0cccb8795b78d3cbaefb8a576a
- https://github.com/igniterealtime/Openfire
- https://web.archive.org/web/20080517012408/http://www.securityfocus.com/bid/28722
- https://web.archive.org/web/20080628231441/http://secunia.com/advisories/29751
- https://web.archive.org/web/20080724051528/http://secunia.com/advisories/29901
More Ignite Realtime Openfire vulnerabilities
- TI-2007-02881 The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does… CVSS 2.0HIGH 7.5
- TI-2009-00476 Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2… CVSS 2.0MEDIUM 4.3
- TI-2006-06973 Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin… CVSS 2.0MEDIUM 4.3
- TI-2005-04607 Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin… CVSS 2.0MEDIUM 4.3
- TI-2005-04606 Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2008-1728 · CVE Program
- CVE-2008-1728 · NVD
- FIRST EPSS
- GHSA-x337-43mr-gg3h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences