WaratekVRT Sign in

CVE-2019-18394 Openfire

Affected softwareOpenfire
Severity9.8 Critical CVSS 3.1 2 scores
Fixed in4.5.0-beta
WeaknessServer-side request forgery (CWE-918)
Published24 Oct 2019
Updated13 Nov 2026

Description

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · honeypot sightings · earliest 2023-11-14.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2026-09-09.
  • EPSS 32% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-18394 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 675 days 2023-11-14 to 2026-11-01
Reported exploitation sysdig.com /blog/crystalray-rising-threat-actor-exploiting-oss-tools 2024-07-11
Reported exploitation tracker.crowdsec.net /cves/CVE-2019-18394 2026-02-04

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC PoC for CVE-2019-18394: unauthenticated full-read SSRF in Openfire <= 4.4.2 FaviconServlet 2026-09-09
Nuclei Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery

Waratek protection

Rule in development

Waratek is working on a rule for this CVE. No rule is available yet, and it isn't certain the rule will work.

Current target: Q2 2027 (may change)

  • Protection none
  • Action in development patch rule; current target Q2 2027, may change
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Rule in development, naming the ARMR SSRF rule (in development).

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: SSRF rule (in development)

Unauthenticated SSRF in Openfire's FaviconServlet: the host request parameter becomes an outbound HttpClient GET and the reply is sent back to the caller. An SSRF rule in development is meant to block an outbound request to an address taken from request parameters. Nothing blocks this CVE until that rule ships.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.igniterealtime.openfire:parent 0 4.5.0-beta unbounded

Products and versions

2 products, 2 version entries
SourceVendorProductSchemeAffected versions
nvd igniterealtime openfire generic ≤ 4.4.2
osv org.igniterealtime.openfire parent generic ＜ 4.5.0

References

URLTags
https://github.com/igniterealtime/Openfire/pull/1497 WEB
https://github.com/igniterealtime/Openfire/commit/c2ccb38250910587498597955d0bbee8b58e46df WEB
https://github.com/igniterealtime/Openfire PACKAGE
https://swarm.ptsecurity.com/openfire-admin-console WEB
https://swarm.ptsecurity.com/openfire-admin-console/

Timeline
Published2019-10-24By the CVE Program.
VulnCheck KEV: earliest evidence2023-11-14Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-01Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.