Description
Openfire is a Jabber server supported by Ignite Realtime. It's a cross-platform Java application, which positions itself as a platform for medium-sized enterprises to control internal communications and make instant messaging easier.
Openfire Admin Console versions before 4.4.3 are vulnerable to a full read SSRF vulnerability in the FaviconServlet. This vulnerability allows an unauthenticated attacker to send arbitrary HTTP GET requests to the internal network and see the responses.
Remediation
Upgrade to the latest version of Openfire (this issue was fixed in version 4.4.3).
References
Related Vulnerabilities
WordPress Plugin All-in-One Video Gallery Multiple Vulnerabilities (2.6.0)
WordPress Plugin PhonePe Payment Solutions Server-Side Request Forgery (1.0.15)
WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.19)
WordPress Plugin Print My Blog-Print, PDF, & eBook Converter Server-Side Request Forgery (1.6.5)