VIR Vulnerability Intelligence Relay

CVE-2017-15911

medium
Published 2017-10-26 · Modified 2023-11-08
CVSS v3
4.8
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v2
3.5
VIR risk
4.8

Description

Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console

Predictions

Exploit likelihood
58%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://issues.igniterealtime.org/browse/OF-1417

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.igniterealtime.openfire:parent<4.1.74.1.7

Application impact
VendorProductVersionsFixed
igniterealtimeopenfire{"endIncluding":"4.1.6"}

References

CWEs

CWE-79

Verify integrity in audit chain (admin only). AS-IS.