TI-2015-05810 Aliases CVE-2015-6973 GHSA-9293-6mw7-gq5j

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire…

HIGH 66CWE-352Published 2015-09-16 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Tampering
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.

Why it matters now

EPSS 0.64818 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:igniterealtime:openfire:3.10.2:::::::*	3.10.2	Vulnerable	igniterealtime

cpe:2.3:a:igniterealtime:openfire:3.10.2:*:*:*:*:*:*:* Versions 3.10.2 Vulnerable ·igniterealtime

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2015-6973
2026-10-03 Alias added: GHSA-9293-6mw7-gq5j

References

Exploit 1

38192

Advisory 1

GLSA-201612-50

Other 2

TI-2023-15609 Openfire administration console authentication bypass KEVCVSS 3.1HIGH 8.6
TI-2024-16737 An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2021-20964 An issue was discovered in Pascom Cloud Phone System before 7.20.x. CVSS 3.1CRITICAL 9.8
TI-2008-06198 Directory traversal vulnerability in the AuthCheck filter in the Admin Console in… CVSS 2.0HIGH 7.5
TI-2024-16736 An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate… CVSS 3.1HIGH 7.2
TI-2019-13396 A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite… CVSS 3.1CRITICAL 9.8

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences