Reflective XSS Vulnerability in Ignite Realtime Openfire
CVE-2020-35200

6.1MEDIUM

Key Information:

Vendor

Igniterealtime

Status
Openfire
Vendor
CVE Published:
12 December 2020

What is CVE-2020-35200?

Ignite Realtime Openfire version 4.6.0 contains a vulnerability in the plugins/clientcontrol/spark-form.jsp file, which allows for Reflective Cross-Site Scripting (XSS) attacks. This weakness enables an attacker to inject malicious scripts into pages viewed by users, potentially leading to unauthorized actions or data exposure. Users of this version are advised to apply necessary updates to mitigate potential risks.

References

https://discourse.igniterealtime.org/t/openfire-4-6-0-has...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.