CVE-2014-3451 : OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.

Published 2017-08-18 18:29:00

Updated 2018-10-09 19:43:48

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2014-3451

Igniterealtime » Openfire
Versions up to, including, (<=) 3.9.3
cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.56%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

http://www.openwall.com/lists/oss-security/2015/04/23/16

oss-security - Incorrect handling of self signed certificates in OpenFire XMPP Server
Mailing List;Third Party Advisory;VDB Entry
https://community.igniterealtime.org/blogs/ignite/2015/04/22/openfire-3100-released

Openfire 3.10.0 Released - Blogs / Ignite Realtime Blogs - Ignite Realtime Community Forums
Release Notes;Vendor Advisory
http://packetstormsecurity.com/files/131614/OpenFire-XMPP-3.9.3-Certificate-Handling.html

OpenFire XMPP 3.9.3 Certificate Handling ≈ Packet Storm
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/74305

Openfire XMPP Server CVE-2014-3451 Spoofing Vulnerability
Third Party Advisory;VDB Entry
http://www.securityfocus.com/archive/1/535363/100/1100/threaded

SecurityFocus

Jump to