CVE-2015-6973: Openfire admin console CSRF allows password, user and SSL changes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaws allow full administrative takeover of Openfire with only admin user interaction, and a public exploit plus very high EPSS score make exploitation likely despite no KEV listing.

What it is

Ignite Realtime Openfire 3.10.2 contains multiple cross-site request forgery flaws in its administrative web interface. An attacker who can lure a logged-in administrator to a crafted page can force privileged actions such as changing passwords, creating users, editing server settings, disabling SSL, or adding permitted clients. Because these actions run with the administrator's session, they can silently weaken or take over the server.

Impact

An attacker gains the ability to perform administrative actions as the victim admin, including account takeover via password change, unauthorized user creation, server reconfiguration, and disabling SSL. This can lead to full compromise of the Openfire deployment and its user accounts.

Attack surface

Reached over the network through the Openfire admin web interface; the victim must be an authenticated administrator and must be induced to load an attacker-controlled page or link. No attacker authentication is required, but user interaction by the admin is needed for the CSRF to fire.

Exploitation

A public Exploit-DB entry (38192) exists and EPSS is high at 0.648 (99.2nd percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade Openfire to a version later than 3.10.2 that addresses these CSRF issues; verify the fixed release with the vendor before deploying.
• If immediate upgrade is not possible, restrict network access to the admin console to trusted management networks only.
• Require administrators to log out of the admin console when not in use and avoid browsing untrusted sites in the same browser session.
• Enable anti-CSRF protections at a reverse proxy or WAF in front of the admin interface where feasible.
• Apply the Gentoo GLSA 201612-50 guidance if Openfire is deployed via Gentoo packages.

Detection

• Monitor admin console access logs for POST requests to user-password.jsp, user-create.jsp, server-props.jsp, and plugins/clientcontrol/permitted-clients.jsp from unexpected referrers.
• Alert on administrator password changes, new user creation, SSL disablement, or server property changes that occur outside normal change windows.
• Correlate web requests to the admin interface with the administrator's normal source IPs and flag requests originating from unusual locations or referrers.
• Review Openfire audit logs for configuration changes and user additions that lack a corresponding authorized change ticket.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.