CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 7.5
CWE Name:  Permissions Privileges and Access Controls
Summary: the admin console in ignite realtime openfire 3.3.0 and earlier (formerly wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through dwr, as demonstrated using the downloader. the vendor has addressed this issue through the release of the following product updates:

ignite realtime openfire-3.3.1-1.i386.rpm
http://www.igniterealtime.org/downloads/download-landing.jsp?file=open fire/openfire-3.3.1-1.i386.rpm

ignite realtime openfire_3_3_1.dmg
http://www.igniterealtime.org/downloads/download-landing.jsp?file=open fire/openfire_3_3_1.dmg

ignite realtime openfire_3_3_1.exe
http://www.igniterealtime.org/downloads/download-landing.jsp?file=open fire/openfire_3_3_1.exe
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2007-06-01
Last Modified Date: 2008-09-10