Cross-Site Scripting in Ignite Realtime Openfire Server
CVE-2017-15911

4.8MEDIUM

Key Information:

Vendor

Igniterealtime

Status
Openfire
Vendor
CVE Published:
26 October 2017

What is CVE-2017-15911?

The Admin Console in Ignite Realtime Openfire Server versions prior to 4.1.7 is vulnerable to Cross-Site Scripting (XSS). This allows attackers to execute arbitrary client-side JavaScript code on the browsers of users who interact with a specially crafted link. Consequently, this can lead to the theft of session IDs and sensitive data, as well as potential bypass of Cross-Site Request Forgery (CSRF) protections. Attackers can also inject iframes, facilitating unauthorized communication channels following successful exploitation. It emphasizes the necessity of securing web applications against XSS vulnerabilities to protect user information and maintain the integrity of user sessions.

References

https://becomepentester.blogspot.ae/2017/10/Cross-Site-Sc...
x_refsource_MISC
https://issues.igniterealtime.org/browse/OF-1417
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.