CVE-2015-6973

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of…

published September 16, 2015

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.2th percentile for exploit probability.

CVSS
—
EPSS
65%
Percentile
99.2
In the wild
Unconfirmed
What it is

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.64818 · 99.2th percentile
Published
2015-09-16T19:00Z
EPSS history
Timeline
  • 16 SEP 19:00Z
    Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of…
    cvelistv5