CVE-2007-2975

The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.

Link	Resource
http://www.igniterealtime.org/issues/browse/JM-1049	Patch Vendor Advisory
http://www.securityfocus.com/bid/24205	Patch
http://secunia.com/advisories/25427	Vendor Advisory
http://www.osvdb.org/36713
http://blogs.reucon.com/srt/2007/05/11/openfire_3_3_1_fixes_critical_security_issue.html

Configuration 1

cpe:2.3:a:ignite_realtime:openfire:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:2.6.1:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.2.2:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.2.3:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.2.4:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:2.6.0:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:*:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:2.6.2:*:*:*:*:*:*:* cpe:2.3:a:ignite_realtime:openfire:3.1.1:*:*:*:*:*:*:*

---

Published : 2007-06-01 01:30

Updated : 2008-09-10 04:00

---

NVD link : CVE-2007-2975

Mitre link : CVE-2007-2975

No products.

CWE-264