Reflected XSS Vulnerability in Ignite Realtime Openfire Web Application
CVE-2020-24604

6.1MEDIUM

Key Information:

Vendor: Igniterealtime
Status: Openfire
Vendor: CVE Published:; 2 September 2020

🔔 Create Igniterealtime Vulnerability Alert

What is CVE-2020-24604?

A reflected Cross-Site Scripting (XSS) vulnerability exists in Ignite Realtime's Openfire version 4.5.1. This flaw allows remote attackers to inject arbitrary web scripts or HTML into requests. Potentially vulnerable parameters include 'searchName', 'searchValue', 'searchDescription', 'searchDefaultValue', 'searchPlugin', and 'searchDynamic' in the 'server-properties.jsp' and 'security-audit-viewer.jsp' files. Attackers can exploit this vulnerability to execute scripts in the context of a user's browser, leading to the potential theft of sensitive information or unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch