diff --git a/cves/2019/CVE-2019-18394.yaml b/cves/2019/CVE-2019-18394.yaml index 711f1e6d9c..5b4891d499 100644 --- a/cves/2019/CVE-2019-18394.yaml +++ b/cves/2019/CVE-2019-18394.yaml @@ -1,13 +1,14 @@ id: CVE-2019-18394 info: - name: Openfire Full Read SSRF + name: Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery author: pdteam severity: critical - description: A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. + description: Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests in FaviconServlet.java, resulting in server-side request forgery. reference: - https://swarm.ptsecurity.com/openfire-admin-console/ - https://github.com/igniterealtime/Openfire/pull/1497 + - https://nvd.nist.gov/vuln/detail/CVE-2019-18394 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 @@ -25,3 +26,5 @@ requests: part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + +# Enhanced by mp on 2022/05/03