PT-2020-10402 · Ignite Realtime · Ignite Realtime Openfire

Published 2020-01-08 · Updated 2022-05-24 · CVE-2019-20366

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.4

Description A cross-site scripting (XSS) issue was discovered in the software. The issue is related to the isTrustStore function, which is used to manage store contents.

Recommendations For Ignite Realtime Openfire version 4.4.4, consider disabling the isTrustStore function to manage store contents until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20366

GHSA-M6PR-XCRM-4QQP

Affected Products

Ignite Realtime Openfire

References · 9

• 🔥 https://cybersecurityworks.com/zerodays/cve-2019-20366-openfire.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20366 · Security Note
• https://issues.igniterealtime.org/browse/OF-1955 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6pr-xcrm-4qqp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20366 · Vendor Advisory
• https://github.com/igniterealtime/Openfire · Note
• https://github.com/igniterealtime/Openfire/pull/1561 · Note
• https://github.com/igniterealtime/Openfire/commit/fef55d4be50da8f66f468d9e7d822528acb8273d · Note
• https://t.me/cvenotify/5482 · Telegram Post