PT-2005-5537 · Ignite Realtime · Openfire

Publicado 2005-12-31 · Atualizado 2017-08-08 · CVE-2005-4877

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Openfire version 2.3.0 Beta 2

Description: A cross-site scripting (XSS) issue exists in the login form of the admin console, allowing remote attackers to inject arbitrary web script or HTML via Javascript events in the username parameter.

Recommendations: For Openfire version 2.3.0 Beta 2, consider restricting access to the login form until a fix is available, and avoid using Javascript events in the username parameter to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2005-4877

Produtos afetados

Openfire

Referências · 3

• http://igniterealtime.org/issues/browse/JM-430 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4877 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44690 · Nota