Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.igniterealtime.openfire:xmppserver

6 known vulnerabilities (1 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
4.2.0 (Dec 7, 2017): affected by 6 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
6 · 1 critical, 2 high, 1 medium
Dependents
3
Releases
1 since 4.2.0 (Dec 7, 2017)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • CVE-2025-59154Medium 5.9

    Openfire allows potential identity spoofing via unsafe CN parsing

    Affected: fixed in 5.0.2.

    No fix released. The advisory names 5.0.2 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

  • CVE-2024-25421Critical 9.8

    An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.

    Affected: fixed in 4.8.1.

    No fix released. The advisory names 4.8.1 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

  • An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system…

    Affected: fixed in 4.8.1.

    No fix released. The advisory names 4.8.1 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

  • CVE-2023-32315High 8.6 · KEV

    Openfire administration console authentication bypass

    Affected: from 3.10.0, fixed in 4.6.8; from 4.7.0, fixed in 4.7.5.

    No fix released. The advisory names 4.6.8 and 4.7.5 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

  • Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

    Affected: fixed in 4.4.2.

    No fix released. The advisory names 4.4.2 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

  • Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

    Affected: fixed in 4.4.1.

    No fix released. The advisory names 4.4.1 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.