CVE-2008-1728 Ignite Realtime Openfire allows remote authenticated users to cause a denial of service

What is CVE-2008-1728?

CVE-2008-1728 is a medium-severity denial of service vulnerability in n/a, published on 11 Apr 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.

Weakness: CWE-399

Which versions are affected by CVE-2008-1728?

4 open source packages ship an affected version, including org.igniterealtime.openfire:openfire and org.igniterealtime.openfire:parent. It affects 1 product.

Products include Ignite Realtime Openfire.

How do I fix CVE-2008-1728?

Upgrade org.igniterealtime.openfire:openfire to 3.5.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2008-1728 being exploited?

There is no known exploitation of CVE-2008-1728 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2007-2975 Missing authorization in n/a High 7.5
• CVE-2009-0496 Cross-site scripting in n/a Medium 4.3
• CVE-2005-4876 Cross-site scripting in n/a Medium 4.3
• CVE-2005-4877 Cross-site scripting in n/a Medium 4.3
• CVE-2006-7233 Cross-site scripting in n/a Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x337-43mr-gg3h.