What’s Vulnerable › Vulnerabilities

CVE-2019-18393

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-24 · updated 2026-06-17
• Weakness: CWE-22

Description

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

Affected products

• igniterealtime Openfire: through 4.4.2

References

• https://github.com/igniterealtime/Openfire/pull/1498
• https://swarm.ptsecurity.com/openfire-admin-console/
• https://github.com/igniterealtime/Openfire/pull/1498
• https://swarm.ptsecurity.com/openfire-admin-console/

Get alerted when CVE-2019-18393 or the next vulnerability affects your stack