CVE-2017-15911 Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console

What is CVE-2017-15911?

CVE-2017-15911 is a medium-severity cross-site scripting vulnerability in n/a, published on 26 Oct 2017. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.

Weakness: CWE-79

Which versions are affected by CVE-2017-15911?

2 open source packages ship an affected version, including org.igniterealtime.openfire:parent. It affects 1 product.

Products include Igniterealtime Openfire.

How do I fix CVE-2017-15911?

Upgrade org.igniterealtime.openfire:parent to 4.1.7 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-15911 being exploited?

There is no known exploitation of CVE-2017-15911 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-32315 Ignite Realtime Openfire Path Traversal Exploited High 8.6
• CVE-2024-25421 Ignite Realtime Openfire privilege escalation vulnerability Critical 9.8
• CVE-2021-45967 Path traversal in n/a Critical 9.8
• CVE-2019-18394 Ignite Realtime Openfire vulnerable to Server Side Request Forgery Critical 9.8
• CVE-2014-2741 Ignite Realtime Openfire vulnerable to XMPPbomb attack High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v3h2-4j2r-wqj8.