org.igniterealtime.openfire:xmppserver (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.igniterealtime.openfire:xmppserver, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2024-25421 — CVSS 9.8 (critical): An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.
• CVE-2023-32315 — CVSS 8.6 (high) — actively exploited: Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was…
• CVE-2024-25420 — CVSS 7.2 (high): An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system…
• CVE-2019-15488 — CVSS 6.1 (medium): Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
• CVE-2019-20528 — CVSS 6.1 (medium): Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.
• CVE-2025-59154 — CVSS 5.9 (medium): Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS…