CVE-2024-25420: High severity maven/org.igniterealtime.openfire:xmppserver vulnerability
An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.
Other sources
An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.
— GitHub
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25420?
CVE-2024-25420 is classified as a critical vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-25420?
To mitigate CVE-2024-25420, upgrade to Openfire version 4.8.1 or later.
Who is affected by CVE-2024-25420?
CVE-2024-25420 affects users of Openfire versions 4.8.0 and earlier, as well as 4.9.0 and earlier.
What types of attacks can exploit CVE-2024-25420?
CVE-2024-25420 allows remote attackers to escalate privileges by manipulating the admin.authorizedJIDs system property.
When was CVE-2024-25420 disclosed?
CVE-2024-25420 was disclosed in 2024, highlighting significant security risks in earlier Openfire versions.