CVE-2019-18393 Ignite Realtime Openfire directory traversal vulnerability

What is CVE-2019-18393?

CVE-2019-18393 is a medium-severity path traversal vulnerability in n/a, published on 24 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

Weakness: CWE-22

Which versions are affected by CVE-2019-18393?

2 open source packages ship an affected version, including org.igniterealtime.openfire:parent. It affects 1 product.

Products include Igniterealtime Openfire.

How do I fix CVE-2019-18393?

Upgrade org.igniterealtime.openfire:parent to 4.5.0-beta or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-18393 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-18393 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2023-32315 Ignite Realtime Openfire Path Traversal Exploited High 8.6
• CVE-2024-25421 Ignite Realtime Openfire privilege escalation vulnerability Critical 9.8
• CVE-2021-45967 Path traversal in n/a Critical 9.8
• CVE-2019-18394 Ignite Realtime Openfire vulnerable to Server Side Request Forgery Critical 9.8
• CVE-2014-2741 Ignite Realtime Openfire vulnerable to XMPPbomb attack High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-59h8-h34r-q9cv.