CVE-2023-32315

Ignite Realtime Openfire Path Traversal

8.6 HIGHActively exploited (CISA KEV)Public exploitEPSS 100.0%

Published26 May 2023
Added to CISA KEV24 Aug 2023
Remediation due14 Sept 2023

Description

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityLow

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected products

Igniterealtime Openfire≥ 3.10.0 < 4.6.8 · ≥ 4.7.0 < 4.7.5

Remediation

Fixed in

Igniterealtime Openfire≥ 4.6.8

Patch & vendor advisories

https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm

References

http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvmExploitMitigationPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32315US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-32315 being actively exploited?

Yes. CVE-2023-32315 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 Aug 2023.

How severe is CVE-2023-32315?

CVE-2023-32315 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2023-32315?

Affected products include Igniterealtime Openfire.

How do I fix CVE-2023-32315?

Upgrade affected software to a fixed version, for example Igniterealtime Openfire 4.6.8 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-32315 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.