# org.igniterealtime.openfire:xmppserver (Maven) vulnerabilities

6 known vulnerabilities (1 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 4.2.0 (Dec 7, 2017): affected by 6 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Dependents: 3
- Releases: 1 since 4.2.0 (Dec 7, 2017)
- Registry: https://central.sonatype.com/artifact/org.igniterealtime.openfire/xmppserver
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2025-59154: 4.2.0 (through the newest release)
- CVE-2024-25421: 4.2.0 (through the newest release)
- CVE-2024-25420: 4.2.0 (through the newest release)
- CVE-2023-32315: 4.2.0 (through the newest release)
- CVE-2019-20528: 4.2.0 (through the newest release)
- CVE-2019-15488: 4.2.0 (through the newest release)

## Advisories (6)

### [CVE-2025-59154](https://cve.now/CVE-2025-59154): Openfire allows potential identity spoofing via unsafe CN parsing

- Severity: Medium 5.9
- Published: Sep 15, 2025
- Affected: fixed in 5.0.2.
- No fix released. The advisory names 5.0.2 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

### [CVE-2024-25421](https://cve.now/CVE-2024-25421): An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM\_CACHE component.

- Severity: Critical 9.8
- Published: Mar 26, 2024
- Affected: fixed in 4.8.1.
- No fix released. The advisory names 4.8.1 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

### [CVE-2024-25420](https://cve.now/CVE-2024-25420): An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system…

- Severity: High 7.2
- Published: Mar 26, 2024
- Affected: fixed in 4.8.1.
- No fix released. The advisory names 4.8.1 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

### [CVE-2023-32315](https://cve.now/CVE-2023-32315): Openfire administration console authentication bypass

- Severity: High 8.6 · KEV
- Published: May 26, 2023
- Affected: from 3.10.0, fixed in 4.6.8; from 4.7.0, fixed in 4.7.5.
- No fix released. The advisory names 4.6.8 and 4.7.5 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

### [CVE-2019-20528](https://cve.now/CVE-2019-20528): Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

- Severity: Unrated
- Published: Mar 18, 2020
- Affected: fixed in 4.4.2.
- No fix released. The advisory names 4.4.2 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

### [CVE-2019-15488](https://cve.now/CVE-2019-15488): Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

- Severity: Unrated
- Published: Aug 23, 2019
- Affected: fixed in 4.4.1.
- No fix released. The advisory names 4.4.1 as the fix, which the registry doesn't have yet. The latest release, 4.2.0, is still affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.igniterealtime.openfire:xmppserver
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.