CVE-2014-2741 — Vulnetix

CVE-2014-2741 PUBLISHED CVSS 7.800000190734863 HIGH

nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

EPSS 3.20% · 87.3th percentile

Risk Scores

CVSS 2.0

7.800000190734863

EPSS Score

3.20%

87.3th percentile

Affected Products

Vendor	Product	Versions
Maven	org.igniterealtime.openfire:parent	0
n/a	n/a	n/a
igniterealtime	openfire	0

Timeline

Apr 11, 2014 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 8, 2023 EPSS Score
Apr 2, 2023 EPSS Score
May 25, 2023 EPSS Score
Jul 16, 2023 EPSS Score
Sep 7, 2023 EPSS Score

References

http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ url
VU#495476 third-party-advisory
http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77 url
[oss-security] 20140408 Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression mailing-list
http://community.igniterealtime.org/thread/52317 url
[oss-security] 20140407 Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2014-2741 advisory
https://github.com/igniterealtime/Openfire/commit/3aec383e07ee893b77396fe946766bbd3758af77 url
https://github.com/igniterealtime/Openfire package
https://web.archive.org/web/20140407092132/http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas url
https://web.archive.org/web/20140705161237/http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77 url

Open in Interactive Console →