CVE-2017-15911

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted…

published October 26, 2017

CVSS
—
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00728 · 53.4th percentile
Published
2017-10-26T17:00Z
EPSS history
Timeline
  • 26 OCT 17:00Z
    The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted…
    cvelistv5