Igniterealtime Openfire

Openfire 4.6.0 NodeJS Plugin XSS via 'path' param
CVE-2020-36956 6.4 - Medium - January 26, 2026

Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing the nodejs configuration page.

XSS

Openfire <5.0.2 SASL EXTERNAL CN Regex & Impersonation
CVE-2025-59154 5.9 - Medium - September 15, 2025

Openfire is an XMPP server licensed under the Open Source Apache License. Openfires SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls X509Certificate.getSubjectDN().getName() and applies a regex to look for CN=. This method produces a provider-dependent string that does not escape special characters. In SunJSSE (sun.security.x509.X500Name), for example, commas and equals signs inside attribute values are not escaped. As a result, a malicious certificate can embed CN= inside another attribute value (e.g. OU="CN=admin,"). The regex will incorrectly interpret this as a legitimate Common Name and extract admin. If SASL EXTERNAL is enabled and configured to map CNs to user accounts, this allows the attacker to impersonate another user. The fix is included in Openfire 5.0.2 and 5.1.0.

Authentication Bypass by Spoofing

Openfire 4.9.0 Privilege Escalation via admin.authorizedJIDs property
CVE-2024-25420 7.2 - High - March 26, 2024

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.

Improper Check for Dropped Privileges

Openfire <=4.9.0 Priv Esc via ROOM_CACHE
CVE-2024-25421 - March 26, 2024

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.

Openfire XMPP Server Path Traversal in Admin Console (3.10.0+) Fix 4.7.5/4.6.8
CVE-2023-32315 8.6 - High - May 26, 2023

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isnt available for a specific release, or isnt quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

Directory traversal

An issue was discovered in Pascom Cloud Phone System before 7.20.x
CVE-2021-45967 9.8 - Critical - March 18, 2022

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.

Directory traversal

Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.
CVE-2020-35202 5.4 - Medium - December 12, 2020

Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.

XSS

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.
CVE-2020-35201 5.4 - Medium - December 12, 2020

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.

XSS

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.
CVE-2020-35200 6.1 - Medium - December 12, 2020

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.

XSS

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.
CVE-2020-35199 5.4 - Medium - December 12, 2020

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.

XSS

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.
CVE-2020-35127 5.4 - Medium - December 11, 2020

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.

XSS

Ignite Realtime Openfire 4.4.1
CVE-2019-20526 - March 19, 2020

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.

Ignite Realtime Openfire 4.4.1
CVE-2019-20525 - March 19, 2020

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.

Ignite Realtime Openfire 4.4.1
CVE-2019-20527 - March 19, 2020

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.

Ignite Realtime Openfire 4.4.1
CVE-2019-20528 - March 18, 2020

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4
CVE-2019-20366 - January 08, 2020

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4
CVE-2019-20365 - January 08, 2020

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4
CVE-2019-20364 - January 08, 2020

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4
CVE-2019-20363 - January 08, 2020

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2
CVE-2019-18394 - October 24, 2019

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure
CVE-2019-18393 - October 24, 2019

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

Ignite Realtime Openfire before 4.4.1 has reflected XSS
CVE-2019-15488 6.1 - Medium - August 23, 2019

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

XSS

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input
CVE-2018-11688 6.1 - Medium - June 13, 2018

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

XSS

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which
CVE-2009-1596 - May 11, 2009

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.