A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite…
Priority HIGH 66CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
Why it matters now
EPSS 0.32304 98th percentileScored 2026-11-07
Fix Fixed org.igniterealtime.openfire:parent (Maven): 4.5.0-beta
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.igniterealtime.openfire:parent (Maven) | before 4.5.0-beta | 4.5.0-beta | Patch available | GHSA-mfjw-x4q4-69p9 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.igniterealtime.openfire:parent (Maven) Vendor— Affected before 4.5.0-beta Fixed in 4.5.0-beta Patch available GHSA-mfjw-x4q4-69p9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:* | up to 4.4.2 | Vulnerable | igniterealtime |
- cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:* Versions up to 4.4.2 Vulnerable ·igniterealtime
Remediation
- Fix · GHSA-mfjw-x4q4-69p9 org.igniterealtime.openfire:parent (Maven) Fixed in 4.5.0-beta Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18394
- 2026-10-03 Alias added: GHSA-mfjw-x4q4-69p9
References
More igniterealtime Openfire vulnerabilities
- TI-2023-15609 Openfire administration console authentication bypass KEVCVSS 3.1HIGH 8.6
- TI-2024-16737 An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2021-20964 An issue was discovered in Pascom Cloud Phone System before 7.20.x. CVSS 3.1CRITICAL 9.8
- TI-2008-06198 Directory traversal vulnerability in the AuthCheck filter in the Admin Console in… CVSS 2.0HIGH 7.5
- TI-2024-16736 An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate… CVSS 3.1HIGH 7.2
- TI-2015-05810 Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2019-18394 · CVE Program
- CVE-2019-18394 · NVD
- FIRST EPSS
- GHSA-mfjw-x4q4-69p9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences