An issue exists in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml.
smartfoxserver smartfoxserver 2.17.0