Ignite Realtime Openfire allows Cross-site Scripting

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-20525 · ADVISORY
• netsparker.com/web-applications-advisories/ns-19-015-reflected-cross-site-scripting-in-openfire · WEB
• netsparker.com/web-applications-advisories/ns-19-015-reflected-cross-site-scripting-in-openfire · Exploit

org.igniterealtime.openfire:parent のその他の脆弱性

• CVE-2019-20526中 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
• CVE-2019-20527中 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
• CVE-2019-20366中 6.1An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
• CVE-2019-18394緊急 9.8A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send…
• CVE-2019-18393中 5.3PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct…