CVE-2019-18394: Server-Side Request Forgery (SSRF)

May 24, 2022 (updated November 22, 2022)

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

References

github.com/advisories/GHSA-mfjw-x4q4-69p9
github.com/igniterealtime/Openfire/commit/c2ccb38250910587498597955d0bbee8b58e46df
github.com/igniterealtime/Openfire/pull/1497
nvd.nist.gov/vuln/detail/CVE-2019-18394
swarm.ptsecurity.com/openfire-admin-console/

Code Behaviors & Features

Detect and mitigate CVE-2019-18394 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →