Login Request a demo
Medium severity · published Oct 26, 2017
CVE-2017-15911
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted…
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openfire · Igniterealtime
through 4.1.6 · source: NVD
Affected product
OP
Openfire
Igniterealtime
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15911
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15911
Issue Tracking
https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html
Issue Tracking
https://issues.igniterealtime.org/browse/OF-1417
More from Openfire
7.5
CVE-2023-32315
Openfire administration console authentication bypass
9.8
CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component
9.8
CVE-2021-45967
An issue was discovered in Pascom Cloud Phone System before 7.20.x
9.8
CVE-2019-18394
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests
7.5
CVE-2014-3451
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks