CVE-2023-32315

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

First PoC 2023-06-14
1043 days →Metasploit 2026-04-22
178 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2023-08-24 · due 2023-09-14. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

13 known · links only

GitHub PoCs · by trust, then stars11

tangxiaofeng7/CVE-2023-32315-Openfire-Bypass ↗Trust ok 100
rce
★ 143 · created 2023-06-14
miko550/CVE-2023-32315 ↗Trust ok 100
Openfire Console Authentication Bypass Vulnerability with RCE plugin
★ 61 · created 2023-06-18
Ap0dexMe0/CVE-2023-32315 ↗Trust ok 100
Perform With Massive Openfire Unauthenticated Users
★ 7 · created 2023-07-02
izzz0/CVE-2023-32315-POC ↗Trust ok 100
CVE-2023-32315-Openfire-Bypass
★ 5 · created 2023-07-07
gibran-abdillah/CVE-2023-32315 ↗Trust ok 100
Tool for CVE-2023-32315 exploitation
★ 3 · created 2023-08-31
5rGJ5aCh5oCq5YW9/CVE-2023-32315exp ↗Trust ok 100
★ 2 · created 2023-06-15
pulentoski/Explotacion-CVE-2023-32315-Openfire ↗Trust ok 100
★ 1 · created 2025-04-14
asepsaepdin/CVE-2023-32315 ↗Trust ok 100
★ 0 · created 2025-01-30
CN016/Openfire-RCE-CVE-2023-32315- ↗Trust ok 100
Openfire未授权到RCE(CVE-2023-32315)复现
★ 0 · created 2023-10-10
CyberCTF/vulhub-openfire-cve-2023-32315 ↗Trust ok 100
Vulhub openfire/CVE-2023-32315: Openfire Admin Console Authentication Bypass (CVE-2023-32315), run with Isoloom
★ 0 · created 2026-10-08
ohnonoyesyes/CVE-2023-32315 ↗Trust ok 100
★ 0 · created 2023-06-14

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

Openfire authentication bypass with RCE plugin ↗
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This
ruby · seen 2026-10-18

Nuclei1

Openfire Administration Console - Authentication Bypass ↗
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire th
yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

Earth Krahang
1. “The threat actors use open-source tools to search public-facing servers for specific vulnerabilities like CVE-2022-21587 (Control Web Panel) and CVE-2023-32315 (Openfire). They use web shells to get unauthorized access and persist on victim networks by taking advantage of these security flaws.”
  cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17
2. “The threat actor abused the following vulnerabilities multiple times: CVE-2023-32315 : command execution on OpenFire”
  cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17
Kinsing
1. “Update (8/27/23) – Aqua Nautilus discovered a new campaign that exploits the Openfire vulnerability (CVE-2023-32315 to deploy Kinsing malware and a cryptominer.”
  cited as exploiting · source: blog.aquasec.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals