CVE-2007-2975
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not...
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
Exploit likelihood
What each source reports
NVD Score used
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
- Record
CVE-2007-2975- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
- Record
CVE-2007-2975- Updated
- 2026-11-02
EUVDEUVD-2007-2967 No score
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
- Record
EUVD-2007-2967- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cxh3-p9rw-hjrr No score
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not...
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
- Record
GHSA-cxh3-p9rw-hjrr- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-2975 is a high vulnerability (CVSS 7.5) in Ignite Realtime Openfire, published June 1, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. No source names a fixed version.