{"id":"CVE-2024-25420","aliases":["EUVD-2024-0837","GHSA-5xvc-rwv8-86p7"],"status":"published","title":"Ignite Realtime Openfire privilege escalation vulnerability","description":"An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.06465,"percentile":0.93826,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-273","CWE-863"],"published":"2024-03-26T00:00:00Z","modified":"2026-10-28T02:30:24Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/openfire_deleted_admin_rce_cve_2024_25420","title":"Openfire Deleted Administrator Account Authentication Bypass RCE","type":"exploit","platform":"Java","date":"2024-03-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/openfire_deleted_admin_rce_cve_2024_25420"}],"fixes":[{"ecosystem":"Maven","package":"org.igniterealtime.openfire:xmppserver","fixed_in":["4.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.igniterealtime.openfire:xmppserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.igniterealtime.openfire:xmppserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1"}]}],"versions":["4.2.0"]}],"products":[{"vendor":"igniterealtime","product":"openfire"}],"references":[{"url":"https://www.igniterealtime.org/projects/openfire/","tags":["x_transferred","Product","Release Notes","web"]},{"url":"https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/admin/AdminManager.java","tags":["x_transferred","Product","web"]},{"url":"https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421","tags":["x_transferred","Exploit","Third Party Advisory","article","web"]},{"url":"https://igniterealtime.atlassian.net/browse/OF-2758","tags":["web"]},{"url":"https://github.com/igniterealtime/Openfire/pull/2411","tags":["fix","web"]},{"url":"https://github.com/igniterealtime/Openfire/releases/tag/v4.8.1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25420","tags":["advisory"]},{"url":"https://www.igniterealtime.org/projects/openfire","tags":["web"]},{"url":"https://github.com/igniterealtime/Openfire/commit/5c022bfa82d71d1710381ab395b100cdbcb8f310","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5xvc-rwv8-86p7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25420.json","tags":["advisory"]},{"url":"https://github.com/igniterealtime/Openfire","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-25420","description":"An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","status":"published","published":"2024-03-26T00:00:00Z","modified":"2025-11-11T13:09:26.855Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:34:04.341725Z"}],"euvd":[{"id":"EUVD-2024-0837","description":"An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","status":"published","published":"2024-03-26T00:00:00Z","modified":"2025-11-11T13:09:26Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:18.896005Z"}],"ghsa":[{"id":"GHSA-5xvc-rwv8-86p7","title":"Ignite Realtime Openfire privilege escalation vulnerability","description":"An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","status":"published","published":"2024-03-26T21:30:47Z","modified":"2025-11-15T02:52:35Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-273","CWE-863"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"nvd":[{"id":"CVE-2024-25420","description":"An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","status":"published","published":"2024-03-26T21:15:52.71Z","modified":"2026-06-17T07:16:00.267Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-25420","description":"An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","status":"published","published":"2024-03-26T00:00:00Z","modified":"2026-10-28T02:30:24.729164995Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"GHSA-5xvc-rwv8-86p7","title":"Ignite Realtime Openfire privilege escalation vulnerability","description":"An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.","status":"published","published":"2024-03-26T21:30:47Z","modified":"2025-11-15T03:09:15.886757Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-273","CWE-863"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}