CVE-2023-32315: Openfire admin console path traversal, actively exploited
The short version: Openfire — the open-source XMPP (chat) server from Ignite Realtime — has a path-traversal flaw (CVE-2023-32315) in its administrative console that lets an unauthenticated attacker reach admin-only pages. In practice attackers chained that access to upload a malicious plugin and execute code. It's in CISA's KEV catalog. If you run Openfire below 4.6.8 / 4.7.5, patch now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated admin-console access, chained to plugin-upload RCE, KEV-listed |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (Ignite Realtime, via GitHub) | 8.6 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| EPSS | ~99.99% · 99.99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-09-14 |
| Known exploited? | Yes — exploited in the wild, including chains to code execution |
| Vulnerability type | CWE-22 path traversal → unauthenticated access to restricted admin pages → plugin-upload RCE |
| Requires authenticated session? | No — unauthenticated |
| Affected | Openfire 3.10.0 through 4.6.x and 4.7.0–4.7.4 (admin console) |
| Fixed in | 4.6.8 and 4.7.5 (and later) |
What you need to know
Openfire's web-based admin console is the target. CVE-2023-32315 abuses the unauthenticated setup environment to path-traverse into pages that are supposed to require an administrator session. That, by itself, is unauthorized access to restricted admin functionality — and in real attacks it was the first move in a chain: reach the admin surface, then use it to upload a malicious plugin and run code on the server.
- It's unauthenticated and network-reachable. No credential — a crafted request reaches the restricted pages.
- The admin console is the pivot. Access there enables plugin upload, which is the practical route to code execution.
- It's KEV-listed and heavily exploited. EPSS sits at the very top; exposed, unpatched servers were found and hit at scale.
How serious we see it
High — unauthenticated access to an administrative console that, in practice, leads to code execution.
NVD scores the traversal itself 7.5 (confidentiality-focused); Ignite Realtime's own CVSS is a touch higher at 8.6. We rate it High because the real-world outcome is the plugin-upload RCE chain on an exposed server, and because it's KEV-listed with essentially maximal EPSS. The bounded, reassuring part: it affects a defined version range, the fixes (4.6.8 and 4.7.5) are published, and exposure is quick to determine.
Recommendations
- Patch now. Upgrade Openfire to 4.6.8 or 4.7.5 (or later).
- Hunt. Review admin-console access logs and the plugins directory for unexpected plugins or uploads around the exposure window.
- If compromised, respond. Remove rogue plugins, rebuild if warranted, and rotate credentials and secrets held by the server.
- Reduce exposure. Keep the Openfire admin console off the public internet; restrict it to trusted networks.
- Confirm your exposure first. Verify whether you run Openfire and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Openfire admin consoles from little more than your domain, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV. We detect and prioritize the exposed, affected server; the continuous outside-in view means a known-exploited admin console is already mapped, so you can go straight to patch-and-verify.