PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct

Summary

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

Timeline

1. Oct 24, 2019, 10:58 AM UTCCVE published
2. Aug 5, 2024, 1:54 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• org.igniterealtime.openfire:parentMaven

  fixed in 4.5.0-beta

References 3