Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2023-32315

HighExploitedPublic exploit

Administration Console authentication bypass in openfire xmppserver

Published May 23, 2023 · Updated Aug 12, 2026 · Also known as BIT-openfire-2023-32315, GHSA-gw42-f939-fhvm

Key Facts

Patch immediately
  • CVE-2023-32315 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Openfire (Igniterealtime), org.igniterealtime.openfire:xmppserver (maven).
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 9, 2023 and is known to be used in ransomware campaigns. Public exploit code is available.
  • EPSS estimates a 100% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Openfire 4.6.8, Openfire 4.7.5, Openfire 4.7.5-r0.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

100%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2023-32315 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVAug 24, 2023Sep 14, 2023Not reported
Industry KEV feedJun 9, 2023Sep 14, 2023Known
CIRCL KEVAug 24, 2023Sep 14, 2023Not reported
ENISA EUVDAug 24, 2023n/aNot reported

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Products

9 affected entries in total
ProductAffected versionsFixed in
OpenfireIgniterealtime>= 3.10.0, >= >= 3.10.0, < 4.6.84.6.8
org.igniterealtime.openfire:xmppservermaven>= 3.10.04.7.5

Patched Releases

Openfire

4.6.8, 4.7.5, 4.7.5-r0

org.igniterealtime.openfire:xmppserver

4.6.8, 4.7.5

Timeline

  1. Publicly disclosed

    May 23, 2023

  2. Added to Industry KEV feed

    Jun 9, 2023

  3. Added to CISA KEV

    Aug 24, 2023

  4. Added to CIRCL KEV

    Aug 24, 2023

  5. Added to ENISA EUVD

    Aug 24, 2023

  6. Last updated

    Aug 12, 2026

Weakness Type

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2023-32315 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo