{"id":"CVE-2024-25421","published":"2024-03-26T00:00:00Z","modified":"2024-08-07T20:13:52Z","title":"An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the…","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.0165,"percentile":0.7643,"provenance":"source"},"cwes":[{"id":"CWE-250","name":"Execution with Unnecessary Privileges"}],"references":[{"url":"https://www.igniterealtime.org/projects/openfire/","tags":[]},{"url":"https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/muc/spi/LocalMUCRoomManager.java","tags":[]},{"url":"https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421","tags":[]}],"priority":{"score":22.1,"factors":[{"name":"EPSS percentile","points":15.29},{"name":"CVSS severity","points":6.86}]},"affected":[{"ecosystem":"Maven","package":"org.igniterealtime.openfire:xmppserver","vulnerableRanges":["<4.8.1"],"patched":["4.8.1"],"from":["GHSA-6pwg-gg6j-5crm"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0848","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-20528","published":"2020-03-18","fixed":"4.4.2","kev":false},{"cve":"CVE-2023-32315","published":"2023-05-26","fixed":"4.7.5","kev":true,"link":{"from":"CVE-2023-32315","to":"CVE-2024-25421","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.igniterealtime.openfire:xmppserver","fromFixed":"4.7.5","toFixed":"4.8.1","daysApart":305}]}},{"cve":"CVE-2024-25420","published":"2024-03-26","fixed":"4.8.1","kev":false},{"cve":"CVE-2024-25421","published":"2024-03-26","fixed":"4.8.1","kev":false},{"cve":"CVE-2025-59154","published":"2025-09-15","fixed":"5.0.2","kev":false}],"package":"Maven:org.igniterealtime.openfire:xmppserver"}}