CVE-2017-15911

Published: Oct 26, 2017Modified: May 13, 2026

4.8

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.

Affected (1)

Products: Igniterealtime: Openfire

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Igniterealtime Openfire	Up to 4.1.6

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://issues.igniterealtime.org/browse/OF-1417

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://issues.igniterealtime.org/browse/OF-1417

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.