CVE-2024-25421 Ignite Realtime Openfire privilege escalation vulnerability

What is CVE-2024-25421?

CVE-2024-25421 is a critical vulnerability in n/a, published on 26 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.

Weakness: CWE-250

Which versions are affected by CVE-2024-25421?

2 open source packages ship an affected version, including org.igniterealtime.openfire:xmppserver. It affects 1 product.

Products include Igniterealtime Openfire.

How do I fix CVE-2024-25421?

Upgrade org.igniterealtime.openfire:xmppserver to 4.8.1 or later.

Is CVE-2024-25421 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-25421 exists.

Other vulnerabilities in n/a

• CVE-2023-32315 Ignite Realtime Openfire Path Traversal Exploited High 8.6
• CVE-2021-45967 Path traversal in n/a Critical 9.8
• CVE-2019-18394 Ignite Realtime Openfire vulnerable to Server Side Request Forgery Critical 9.8
• CVE-2014-2741 Ignite Realtime Openfire vulnerable to XMPPbomb attack High 7.8
• CVE-2014-3451 Security feature bypass in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6pwg-gg6j-5crm.