Openfire CVE-2014-3451

HIGH

Improper Certificate Validation (CWE-295)

2017-08-18 cve@mitre.org

Information Disclosure Openfire

7.5

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

1

CVE Published

Aug 18, 2017 - 18:29 cve.org

HIGH 7.5

DescriptionCVE.org

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.

AnalysisAI

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-295. OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks. Affected products include: Igniterealtime Openfire. Version information: before 3.10.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Openfire

View all

CVE-2023-32315 HIGH Act Now POC

Openfire is an XMPP server licensed under the Open Source Apache License. Rated high severity (CVSS 7.5), this vulnerabi

CVE-2015-6973 MEDIUM This Month POC

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to

CVE-2024-25421 CRITICAL Act Now POC

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CAC

CVE-2019-18394 CRITICAL Act Now POC

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allo

CVE-2015-7707 MEDIUM This Month POC

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter

CVE-2024-25420 HIGH This Week POC

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authoriz

CVE-2020-35200 MEDIUM This Month POC

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS. Rated medium severity (CVSS 6.1)

CVE-2020-24604 MEDIUM This Month POC

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. Rated medium severity (CVSS 6.1)

CVE-2020-24602 MEDIUM This Month POC

Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute ar

CVE-2020-24601 MEDIUM This Month POC

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious

CVE-2018-11688 MEDIUM This Month POC

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-suppl

CVE-2020-35202 MEDIUM This Month POC

Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS. Rated medium severity (CVSS 5.4), this

Same weakness CWE-295 – Improper Certificate Validation

View all

CVE-2015-3152 MEDIUM POC

CVE-2017-2800 CRITICAL POC

CVE-2014-1266 HIGH POC

CVE-2022-47758 CRITICAL POC

CVE-2025-68121 CRITICAL POC

CVE-2025-29331 CRITICAL POC

CVE-2025-32878 CRITICAL POC

CVE-2024-3738 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2014-3451 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy