CVE-2019-18394

Name of the Vulnerable Software and Affected Versions Openfire versions through 4.4.2

Description A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests, which can be exploited by a remote attacker.

Recommendations For versions through 4.4.2, update to version 4.5.0-beta or later to resolve the issue. As a temporary workaround, consider restricting access to the FaviconServlet.java function to minimize the risk of exploitation.