Detections
Analytics
Openfire Admin Console login.jsp XSS
medium Nessus Plugin ID 51143
Language:
Synopsis
A web application on the remote host has a cross-site scripting vulnerability.Description
The Openfire admin console running on the remote host has a cross-site scripting vulnerability. Input to the 'username' parameter of 'login.jsp' is not properly sanitized.An attacker could exploit this by tricking a user into making a specially crafted POST request, resulting in arbitrary script execution in the user's browser.
This version of Openfire likely has other vulnerabilities, though Nessus has not checked for those issues.
Solution
Upgrade to Openfire 3.7.0 beta or later.See Also
Plugin Details
Severity: Medium
ID: 51143
File Name: openfire_login_xss.nasl
Version: 1.7
Type: remote
Family: CGI abuses : XSS
Published: 12/13/2010
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:igniterealtime:openfire
Required KB Items: www/openfire_console
Patch Publication Date: 8/26/2010
Vulnerability Publication Date: 8/26/2010