Stored Cross-Site Scripting Vulnerability in Ignite Realtime Openfire
CVE-2020-24601

6.1MEDIUM

Key Information:

Vendor

Igniterealtime

Status
Openfire
Vendor
CVE Published:
2 September 2020

What is CVE-2020-24601?

In Ignite Realtime Openfire version 4.5.1, a vulnerability exists in which an attacker can exploit a stored cross-site scripting flaw, enabling them to execute arbitrary malicious URLs through the vulnerable POST parameters 'searchName' and 'alias' in the import certificate trusted page. This can lead to unauthorized actions and compromise user interactions within the application, posing significant security risks to affected installations.

References

https://issues.igniterealtime.org/browse/OF-1963
x_refsource_MISC
https://cybersecurityworks.com/zerodays/cve-2020-24601-ig...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.