Vulnerability in Ignite Realtime Openfire
CVE-2007-2975
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
EPSS: 0.025 (83.3th percentile) — read the EPSS interpretation.
Affected products
- Ignite_realtime Openfire — versions 2.6.0, 2.6.1, 2.6.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID)