CVE-2019-18394

—

CVSS 3.1

9.8 critical

EPSS

32%p98

Published

Oct 24, 2019 (Oct 24, 2019)

Modified

Jun 17, 2026

Description

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

Vendors: igniterealtime
Products: openfire
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (32.3%)

In the news3 stories

Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes

Palo Alto Unit 42Jun 6, 01:14 UTC · Jun 6, 2024Exploit / PoC CVE-2017-9506 CVE-2017-12629 CVE-2019-2767+23 CVEs

Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses

The Hacker NewsMar 9, 09:48 UTC · Mar 9, 2022Vulnerability CVE-2019-18394

CrystalRay operations have scaled 10x to over 1,500 victims

Security AffairsJul 11, 20:45 UTC · Jul 11, 2024Vulnerability CVE-2022-44877 CVE-2021-3129 CVE-2019-18394