CVE-2019-18393 is a directory traversal vulnerability in Ignite Realtime Openfire versions through 4.4.2, specifically within the PluginServlet.java component. This flaw allows an unauthenticated attacker to access arbitrary files outside the intended Openfire home directory. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score indicating a higher-than-average likelihood of exploitation, with potential for information disclosure. While not listed in CISA's KEV catalog, exploit templates are available for tools like Nuclei, suggesting active interest from security researchers. Despite this, there is no public community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.4.2CPE matchmatch criteria | cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.