PT-2005-5536 · Ignite Realtime · Openfire

Publicado 2005-12-31 · Atualizado 2017-08-08 · CVE-2005-4876

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Openfire versions 2.2.2 through 2.3.0 Beta 2

Description: A cross-site scripting (XSS) issue exists in the login form of the admin console, allowing remote attackers to inject arbitrary web script or HTML via the username parameter. This enables attackers to potentially execute malicious scripts on the client-side.

Recommendations: For Openfire versions 2.2.2 through 2.3.0 Beta 2, consider disabling the login form in the admin console until a fix is available, and restrict access to the login.jsp page to minimize the risk of exploitation. Avoid using the username parameter in the login form until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2005-4876

Produtos afetados

Openfire

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-4876 · Nota de Segurança
• http://igniterealtime.org/issues/browse/JM-430 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44689 · Nota