PR: 277054 --- security/vuxml/vuln/2024.xml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index a3c894d13d87..45edda3e3fc6 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,42 @@ + + Openfire administration console authentication bypass + + + openfire + 4.6.8 + + + + +

security-advisories@github.com reports:

+
+

Openfire's administrative console, a web-based + application, was found to be vulnerable to a path traversal attack + via the setup environment. This permitted an unauthenticated user + to use the unauthenticated Openfire Setup Environment in an already + configured Openfire environment to access restricted pages in the + Openfire Admin Console reserved for administrative users. This + vulnerability affects all versions of Openfire that have been + released since April 2015, starting with version 3.10.0. The problem + has been patched in Openfire release 4.7.5 and 4.6.8, and further + improvements will be included in the yet-to-be released first version + on the 4.8 branch (which is expected to be version 4.8.0). Users + are advised to upgrade. If an Openfire upgrade isnt available for + a specific release, or isnt quickly actionable, users may see the + linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

+
+ + + + CVE-2023-32315 + https://nvd.nist.gov/vuln/detail/CVE-2023-32315 + + + 2023-05-26 + 2024-05-21 + + + Roundcube -- Cross-site scripting vulnerabilities