GHSA-mfjw-x4q4-69p9
Ignite Realtime Openfire vulnerable to Server Side Request Forgery
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.igniterealtime.openfire:parent | < 4.5.0-beta | 4.5.0-beta |
Details
As written in the advisory (Markdown source, shown as plain text).
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. The issue is fixed in version 4.5.0-beta.
References
External links from the advisory. They lead to third-party sites.