Ignite Realtime Openfire server-props.jsp Cross-Site Request Forgery (CVE-2015-6973)

A cross-site request forgery vulnerability has been reported in Openfire's server-props.jsp script. The vulnerability is due to insufficient CSRF protections. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user with administrative privileges to visit a page which...

PT-2015-7431

Name of the Vulnerable Software and Affected Versions Openfire version 3.10.2 Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities. Specifically,...

CVE-2015-6973: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...