---
id: 5134
title: "Vulnerabilities in the Openfire Admin Console"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/openfire-admin-console/"
published_at: "2020-08-04T14:16:08Z"
tags: ["vulnerability-research", "cve", "ssrf", "file-read", "openfire"]
phying_url: "https://phying.com/item/5134"
lang: en
---

# Vulnerabilities in the Openfire Admin Console

## Summary

Two vulnerabilities in the Openfire Admin Console: an unauthenticated full-read SSRF through FaviconServlet (CVE-2019-18394) that can reach internal services, and a Windows-only arbitrary file read via PluginServlet path handling (CVE-2019-18393) that requires an admin account.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2020-08-04T14:16:08Z
- **Original:** https://swarm.ptsecurity.com/openfire-admin-console/
- **Phying News:** https://phying.com/item/5134