CVE-2020-24601

2020-09-0215:15:10

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.8%

JSON

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", “alias” in the import certificate trusted page

CPENameOperatorVersion
openfireeq4.1.0
openfireeqattic/pubsub_clustering
openfireeq4.4.0beta
openfireeq3.10.0
openfireeq4.4.0
openfireeq4.2.0
openfireeq4.0.0.beta
openfireeq4.2.0beta
openfireeq3.9.3
openfireeq4.3.0

Name	Operator	Version
openfire	eq	4.1.0
openfire	eq	attic/pubsub_clustering
openfire	eq	4.4.0beta
openfire	eq	3.10.0
openfire	eq	4.4.0
openfire	eq	4.2.0
openfire	eq	4.0.0.beta
openfire	eq	4.2.0beta
openfire	eq	3.9.3
openfire	eq	4.3.0