Vulnerability Report

CVE-2017-15911

Title: Igniterealtime Openfire Cross-Site Scripting (XSS)

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2017-15911.

CWE Category CWE-79

Published Date Oct 26, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 4.8 CVSS v3.0

Exploit Probability (EPSS)

0.73%

Vulnerability Summary

CVE-2017-15911: The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.

Impacted Vendors

ignite_realtime 1

igniterealtime 1

Reference Links

https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html https://issues.igniterealtime.org/browse/OF-1417 https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html https://issues.igniterealtime.org/browse/OF-1417

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

4.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity LOW

3.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:S/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns