NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2019-18394

CVSS 3.1: 9.8 critical
EPSS: 32%p98
Published: Oct 24, 2019 · Oct 24, 2019
Modified: Jun 17, 2026

Analyze CVE-2019-18394 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

Vendors: igniterealtime

Products: openfire

Weakness: CWE-918

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (32.3%)

In the news

3 stories

Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes

Palo Alto Unit 42Jun 6, 01:14 UTC · Jun 6, 2024Exploit / PoCCVE-2017-9506 CVE-2017-12629 CVE-2019-2767+233

60

Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses

The Hacker NewsMar 9, 09:48 UTC · Mar 9, 2022VulnerabilityCVE-2019-183943 · 1 read

60

CrystalRay operations have scaled 10x to over 1,500 victims

Security AffairsJul 11, 20:45 UTC · Jul 11, 2024VulnerabilityCVE-2022-44877 CVE-2021-3129 CVE-2019-183943 · 1 read

47