Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vulnerabilities in the Openfire Admin Console

swarm.ptsecurity.com | research | #vulnerability-research | #cve | #ssrf | #file-read | #openfire

Summary

Two vulnerabilities in the Openfire Admin Console: an unauthenticated full-read SSRF through FaviconServlet (CVE-2019-18394) that can reach internal services, and a Windows-only arbitrary file read via PluginServlet path handling (CVE-2019-18393) that requires an admin account.
Published
Collected

original ↗

Related coverage

  1. Grafana 6.4.3 Arbitrary File Read (swarm.ptsecurity.com)
  2. How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise (hackenproof.com)
  3. Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle (xbow.com)
  4. Blind trust: what is hidden behind the process of creating your PDF file? (swarm.ptsecurity.com)
  5. Vulnerabilities in McAfee ePolicy Orchestrator (swarm.ptsecurity.com)
  6. Cracking the lens: targeting HTTP's hidden attack-surface (portswigger.net)

back