Openfire is a Jabber server supported by Ignite Realtime. It's a cross-platform Java application, which positions itself as a platform for medium-sized enterprises to control internal communications and make instant messaging easier.

Openfire Admin Console versions before 4.4.3 are vulnerable to a full read SSRF vulnerability in the FaviconServlet. This vulnerability allows an unauthenticated attacker to send arbitrary HTTP GET requests to the internal network and see the responses.


Upgrade to the latest version of Openfire (this issue was fixed in version 4.4.3).


Related Vulnerabilities