VDB
CVE-2009-0496
CVE-2009-0496
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) log parameter to (a) logviewer.jsp and (b) log.jsp; (2) search parameter to (c) group-summary.jsp; (3) username parameter to (d) user-properties.jsp; (4) logDir, (5) maxTotalSize, (6) maxFileSize, (7) maxDays, and (8) logTimeout parameters to (e) audit-policy.jsp; (9) propName parameter to (f) server-properties.jsp; and the (10) roomconfig_roomname and (11) roomconfig_roomdesc parameters to (g) muc-room-edit-form.jsp. NOTE: this can be leveraged for arbitrary code execution by using XSS to upload a malicious plugin.
EPSS 14.82% · 94.6th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
14.82%
94.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ignite_realtime | openfire | 3.6.2 |
| n/a | n/a | n/a |
Timeline
- Jan 8, 2009 PoC Published
- Feb 10, 2009 CVE Published
- Feb 4, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 15, 2023 EPSS Score
- Jun 29, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Sep 8, 2023 EPSS Score
References
- https://bugs.gentoo.org/show_bug.cgi?id=254309 url
- 32943 vdb
- openfire-serverproperties-xss(47835) vdb
- 32940 vdb
- 32944 vdb
- http://www.igniterealtime.org/issues/browse/JM-1506 url
- 33452 third-party-advisory
- 32935 vdb
- openfire-mucroomeditform-xss(47845) vdb
- openfire-multiple-scripts-xss(47834) vdb
- 32939 vdb
- 32938 vdb
- 32937 vdb
- 20090108 CORE-2008-1128: Openfire multiple vulnerabilities mailing-list
- http://www.coresecurity.com/content/openfire-multiple-vulnerabilities url
- https://nvd.nist.gov/vuln/detail/CVE-2009-0496 advisory