PT-2005-5536 · Ignite Realtime · Openfire

Published 2005-12-31 · Updated 2017-08-08 · CVE-2005-4876

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Openfire versions 2.2.2 through 2.3.0 Beta 2

Description: A cross-site scripting (XSS) issue exists in the login form of the admin console, allowing remote attackers to inject arbitrary web script or HTML via the username parameter. This enables attackers to potentially execute malicious scripts on the client-side.

Recommendations: For Openfire versions 2.2.2 through 2.3.0 Beta 2, consider disabling the login form in the admin console until a fix is available, and restrict access to the login.jsp page to minimize the risk of exploitation. Avoid using the username parameter in the login form until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2005-4876

Affected Products

Openfire

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-4876 · Security Note
• http://igniterealtime.org/issues/browse/JM-430 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44689 · Note