CVE-2020-24604

2020-09-0215:15:10

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.8%

JSON

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request “searchName”, “searchValue”, “searchDescription”, “searchDefaultValue”,“searchPlugin”, “searchDescription” and “searchDynamic” in server-properties.jsp and security-audit-viewer.jsp

CPENameOperatorVersion
openfireeq4.1.0
openfireeqattic/pubsub_clustering
openfireeq4.4.0beta
openfireeq3.10.0
openfireeq4.4.0
openfireeq4.2.0
openfireeq4.0.0.beta
openfireeq4.2.0beta
openfireeq3.9.3
openfireeq4.3.0

Name	Operator	Version
openfire	eq	4.1.0
openfire	eq	attic/pubsub_clustering
openfire	eq	4.4.0beta
openfire	eq	3.10.0
openfire	eq	4.4.0
openfire	eq	4.2.0
openfire	eq	4.0.0.beta
openfire	eq	4.2.0beta
openfire	eq	3.9.3
openfire	eq	4.3.0