Vulnerability Details CVE-2019-18394
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.323
EPSS Ranking 98.1%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
Products affected by CVE-2019-18394
-
cpe:2.3:a:igniterealtime:openfire:3.10.0
-
cpe:2.3:a:igniterealtime:openfire:3.10.1
-
cpe:2.3:a:igniterealtime:openfire:3.10.2
-
cpe:2.3:a:igniterealtime:openfire:3.10.3
-
cpe:2.3:a:igniterealtime:openfire:3.3.0
-
cpe:2.3:a:igniterealtime:openfire:3.3.1
-
cpe:2.3:a:igniterealtime:openfire:3.3.2
-
cpe:2.3:a:igniterealtime:openfire:3.3.3
-
cpe:2.3:a:igniterealtime:openfire:3.4.0
-
cpe:2.3:a:igniterealtime:openfire:3.4.1
-
cpe:2.3:a:igniterealtime:openfire:3.4.2
-
cpe:2.3:a:igniterealtime:openfire:3.4.3
-
cpe:2.3:a:igniterealtime:openfire:3.4.4
-
cpe:2.3:a:igniterealtime:openfire:3.4.5
-
cpe:2.3:a:igniterealtime:openfire:3.5.0
-
cpe:2.3:a:igniterealtime:openfire:3.5.1
-
cpe:2.3:a:igniterealtime:openfire:3.5.2
-
cpe:2.3:a:igniterealtime:openfire:3.6.0
-
cpe:2.3:a:igniterealtime:openfire:3.6.1
-
cpe:2.3:a:igniterealtime:openfire:3.6.2
-
cpe:2.3:a:igniterealtime:openfire:3.6.3
-
cpe:2.3:a:igniterealtime:openfire:3.6.4
-
cpe:2.3:a:igniterealtime:openfire:3.6.5
-
cpe:2.3:a:igniterealtime:openfire:3.7.0
-
cpe:2.3:a:igniterealtime:openfire:3.7.1
-
cpe:2.3:a:igniterealtime:openfire:3.8.0
-
cpe:2.3:a:igniterealtime:openfire:3.8.1
-
cpe:2.3:a:igniterealtime:openfire:3.8.2
-
cpe:2.3:a:igniterealtime:openfire:3.9.0
-
cpe:2.3:a:igniterealtime:openfire:3.9.1
-
cpe:2.3:a:igniterealtime:openfire:3.9.2
-
cpe:2.3:a:igniterealtime:openfire:3.9.3
-
cpe:2.3:a:igniterealtime:openfire:4.0.0
-
cpe:2.3:a:igniterealtime:openfire:4.0.1
-
cpe:2.3:a:igniterealtime:openfire:4.0.2
-
cpe:2.3:a:igniterealtime:openfire:4.0.3
-
cpe:2.3:a:igniterealtime:openfire:4.0.4
-
cpe:2.3:a:igniterealtime:openfire:4.1.0
-
cpe:2.3:a:igniterealtime:openfire:4.1.1
-
cpe:2.3:a:igniterealtime:openfire:4.1.2
-
cpe:2.3:a:igniterealtime:openfire:4.1.3
-
cpe:2.3:a:igniterealtime:openfire:4.1.4
-
cpe:2.3:a:igniterealtime:openfire:4.1.5
-
cpe:2.3:a:igniterealtime:openfire:4.1.6
-
cpe:2.3:a:igniterealtime:openfire:4.2.0
-
cpe:2.3:a:igniterealtime:openfire:4.2.1
-
cpe:2.3:a:igniterealtime:openfire:4.2.2
-
cpe:2.3:a:igniterealtime:openfire:4.2.3
-
cpe:2.3:a:igniterealtime:openfire:4.2.4
-
cpe:2.3:a:igniterealtime:openfire:4.3.0
-
cpe:2.3:a:igniterealtime:openfire:4.3.1
-
cpe:2.3:a:igniterealtime:openfire:4.3.2
-
cpe:2.3:a:igniterealtime:openfire:4.4.0
-
cpe:2.3:a:igniterealtime:openfire:4.4.1
-
cpe:2.3:a:igniterealtime:openfire:4.4.2