
CVE-2023-32315: Openfire Admin Console Auth Bypass and RCE
CVE-2023-32315 is a critical path traversal vulnerability in the Openfire XMPP messaging server admin console (versions 3.10.0 through 4.7.4), patched in May 2023. An unauthenticated attacker can access the admin console setup wizard by bypassing the authentication filter via a URL path traversal, then upload a malicious Openfire plugin containing arbitrary Java code. Over 3,000 servers were compromised in active exploitation campaigns observed through mid-2023.
