{"id":"CVE-2024-25420","published":"2024-03-26T00:00:00Z","modified":"2025-11-11T13:09:26Z","title":"An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the…","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01431,"percentile":0.7294,"provenance":"source"},"cwes":[{"id":"CWE-273","name":"Improper Check for Dropped Privileges"}],"references":[{"url":"https://www.igniterealtime.org/projects/openfire/","tags":[]},{"url":"https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/admin/AdminManager.java","tags":[]},{"url":"https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421","tags":[]},{"url":"https://igniterealtime.atlassian.net/browse/OF-2758","tags":[]},{"url":"https://github.com/igniterealtime/Openfire/pull/2411","tags":[]},{"url":"https://github.com/igniterealtime/Openfire/releases/tag/v4.8.1","tags":[]}],"priority":{"score":19.6,"factors":[{"name":"EPSS percentile","points":14.59},{"name":"CVSS severity","points":5.04}]},"affected":[{"ecosystem":"Maven","package":"org.igniterealtime.openfire:xmppserver","vulnerableRanges":["<4.8.1"],"patched":["4.8.1"],"from":["GHSA-5xvc-rwv8-86p7"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0837","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-15488","published":"2019-08-23","fixed":"4.4.1","kev":false},{"cve":"CVE-2019-20528","published":"2020-03-18","fixed":"4.4.2","kev":false},{"cve":"CVE-2023-32315","published":"2023-05-26","fixed":"4.7.5","kev":true,"link":{"from":"CVE-2023-32315","to":"CVE-2024-25420","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.igniterealtime.openfire:xmppserver","fromFixed":"4.7.5","toFixed":"4.8.1","daysApart":305}]}},{"cve":"CVE-2024-25420","published":"2024-03-26","fixed":"4.8.1","kev":false},{"cve":"CVE-2024-25421","published":"2024-03-26","fixed":"4.8.1","kev":false},{"cve":"CVE-2025-59154","published":"2025-09-15","fixed":"5.0.2","kev":false}],"package":"Maven:org.igniterealtime.openfire:xmppserver"}}