Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2023-32315

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

CVSS 8.6 · HighBuzz score 56.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 56.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 23.0 · diversity 8.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
23.0
9 evidence mentions in the snapshot
Diversity score
8.0
3 sources across 1 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
9 source links · newest first
  • Sandworm APT’s initial access subgroup hits organizations accross the globeHelp Net Security

    A subgroup of Russia’s Sandworm APT has been working to achieve initial and persistent access to the IT networks of organizations working in economic sectors Russia is interested in. “In 2022, its primary focus was Ukraine, specifically targeting the energy, retail, education, consulting, and agriculture sectors. In 2023, it globalized the scope of its compromises, leading to persistent access within numerous sectors in the United States, Europe, Central Asia, and the Middle East,” Microsoft’s researchers … More →

    newswww.helpnetsecurity.comFeb 13, 2025, 1:25 PM
  • Russia-linked APT Seashell Blizzard is behind the long running global access operation BadPilot campaignSecurity Affairs

    A subgroup of the Russia-linked Seashell Blizzard APT group (aka Sandworm) ran a global multi-year initial access operation called BadPilot. Microsoft shared findings on research on a subgroup of the Russia-linked APT group Seashell Blizzard behind the global BadPilot campaign, which compromises infrastructure to support Russian cyber operations. Seashell Blizzard (aka Sandworm, BlackEnergy and TeleBots) has been […]

    newssecurityaffairs.comFeb 13, 2025, 12:21 PM
  • Russian Seashell Blizzard Hackers Have Access to Critical Infrastructure: MicrosoftSecurityWeek

    A subgroup of the Russia-linked Seashell Blizzard is tasked with broad initial access operations to sustain long-term persistence.

    newswww.securityweek.comFeb 12, 2025, 5:01 PM
  • Chinese APT Hacks 48 Government OrganizationsSecurityWeek

    Earth Krahang, likely a penetration team of Chinese government contractor I-Soon, has compromised 48 government entities worldwide.

    newswww.securityweek.comMar 19, 2024, 1:00 PM
  • Earth Krahang APT breached tens of government organizations worldwideSecurity Affairs

    Trend Micro uncovered a sophisticated campaign conducted by Earth Krahang APT group that breached 70 organizations worldwide. Trend Micro researchers uncovered a sophisticated campaign conducted by a threat actor tracked as Earth Krahang while investigating the activity of China-linked APT Earth Lusca. The campaign seems active since at least early 2022 and focuses primarily on […]

    newssecurityaffairs.comMar 19, 2024, 8:33 AM
  • ‘Looney Tunables’ Glibc Vulnerability Exploited in Cloud AttacksSecurityWeek

    Glibc vulnerability affecting major Linux distributions and tracked as Looney Tunables exploited in cloud attacks by Kinsing group.

    newswww.securityweek.comNov 6, 2023, 12:56 PM
  • Security Affairs newsletter Round 434 by Pierluigi Paganini – International editionSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Cloud and hosting provider Leaseweb took down critical systems after a cyber attack French employment agency […]

    newssecurityaffairs.comAug 27, 2023, 1:59 PM
  • More than 3,000 Openfire servers exposed to attacks using a new exploitSecurity Affairs

    Researchers warn that more than 3,000 unpatched Openfire servers are exposed to attacks using an exploit for a recent flaw. Vulncheck researchers discovered more than 3,000 Openfire servers vulnerable to the CVE-2023-32315 flaw that are exposed to attacks using a new exploit. Openfire is a popular open-source chat server written in Java that is maintained by Ignite Realtime. […]

    newssecurityaffairs.comAug 24, 2023, 7:12 AM
  • 3,000 Openfire Servers Exposed to Attacks Targeting Recent VulnerabilitySecurityWeek

    More than 3,000 Openfire servers are not patched against a recent vulnerability and are exposed to attacks employing a new exploit.

    newswww.securityweek.comAug 23, 2023, 1:21 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2021-45967

    An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server,…

    CVSS 9.8 · Critical
  • CVE-2019-18393

    PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerab…

    CVSS 5.3 · Medium
  • CVE-2008-6508

    Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin…

    CVSS 7.5 · High
  • CVE-2009-0497

    Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter.

    CVSS 5.0 · Medium
  • CVE-2026-67247

    A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before be…

    CVSS 7.1 · High
    1 mention
  • CVE-2026-67246

    A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated bef…

    CVSS 6.9 · Medium
    1 mention