// For flags

CVE-2017-15911

 

Severity Score

4.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.

La consola de administrador en Ignite Realtime Openfire Server en versiones anteriores a la 4.1.7 permite la ejecución arbitraria de código JavaScript del lado del cliente en víctimas que hagan clic en un enlace setup/setup-host-settings.jsp?domain= manipulado. Esto también se conoce como XSS. El robo de ID o datos de sesión podría ocurrir a continuación, así como la posibilidad de omitir las protecciones anti CSRF, la inyección de iframes para establecer canales de comunicación, etc. La vulnerabilidad está presente tras iniciar sesión en la aplicación.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-10-25 CVE Reserved
  • 2017-10-26 CVE Published
  • 2023-09-05 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Igniterealtime
Search vendor "Igniterealtime"
Openfire
Search vendor "Igniterealtime" for product "Openfire"
<= 4.1.6
Search vendor "Igniterealtime" for product "Openfire" and version " <= 4.1.6"
-
Affected