cnvd - cnvd-2017-35298

CNVD-2017-35298

Vulnerability from cnvd - Published: 2017-11-29

Title

Ignite Realtime Openfire跨站脚本漏洞

Description

Openfire是基于XMPP（Jabber）协议的跨平台实时协作服务器。 Ignite Realtime Openfire服务器4.1.7之前版本中的管理控制台存在跨站脚本漏洞。攻击者可通过特制setup/setup-host-settings.jsp?domain=链接在受害者客户端执行任意JavaScript代码。

Severity

低

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： http://www.igniterealtime.org/projects/

Reference

https://issues.igniterealtime.org/browse/OF-1417

Impacted products

Name
Ignite Realtime Openfire Server <4.1.7

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-15911"
    }
  },
  "description": "Openfire\u662f\u57fa\u4e8eXMPP\uff08Jabber\uff09\u534f\u8bae\u7684\u8de8\u5e73\u53f0\u5b9e\u65f6\u534f\u4f5c\u670d\u52a1\u5668\u3002\r\n\r\nIgnite Realtime Openfire\u670d\u52a1\u56684.1.7\u4e4b\u524d\u7248\u672c\u4e2d\u7684\u7ba1\u7406\u63a7\u5236\u53f0\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u7279\u5236setup/setup-host-settings.jsp?domain=\u94fe\u63a5\u5728\u53d7\u5bb3\u8005\u5ba2\u6237\u7aef\u6267\u884c\u4efb\u610fJavaScript\u4ee3\u7801\u3002",
  "discovererName": "Ignite Realtime",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttp://www.igniterealtime.org/projects/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-35298",
  "openTime": "2017-11-29",
  "products": {
    "product": "Ignite Realtime Openfire Server \u003c4.1.7"
  },
  "referenceLink": "https://issues.igniterealtime.org/browse/OF-1417",
  "serverity": "\u4f4e",
  "submitTime": "2017-10-27",
  "title": "Ignite Realtime Openfire\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2017-15911 (GCVE-0-2017-15911)

Vulnerability from cvelistv5 – Published: 2017-10-26 17:00 – Updated: 2024-08-05 20:04

Summary

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://becomepentester.blogspot.ae/2017/10/Cross…	x_refsource_MISC
	https://issues.igniterealtime.org/browse/OF-1417	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:04:50.529Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://issues.igniterealtime.org/browse/OF-1417"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-10-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-26T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://issues.igniterealtime.org/browse/OF-1417"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-15911",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html",
              "refsource": "MISC",
              "url": "https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html"
            },
            {
              "name": "https://issues.igniterealtime.org/browse/OF-1417",
              "refsource": "MISC",
              "url": "https://issues.igniterealtime.org/browse/OF-1417"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-15911",
    "datePublished": "2017-10-26T17:00:00",
    "dateReserved": "2017-10-25T00:00:00",
    "dateUpdated": "2024-08-05T20:04:50.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-35298

CVE-2017-15911 (GCVE-0-2017-15911)

Tags

Sightings

Nomenclature