CVE-2015-6973
Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administra…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Openfire 3.10.2 - Cross-Site Request Forgery2015-09-15 · webapps · jsp
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Igniterealtime | Openfire | Version 3.10.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt
- http://packetstormsecurity.com/files/133554/Openfire-3.10.2-Cross-Site-Request-Forgery.html
- http://www.securityfocus.com/archive/1/536470/100/0/threaded
- https://security.gentoo.org/glsa/201612-50
- https://www.exploit-db.com/exploits/38192/
- http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt
- http://packetstormsecurity.com/files/133554/Openfire-3.10.2-Cross-Site-Request-Forgery.html
- http://www.securityfocus.com/archive/1/536470/100/0/threaded
- https://security.gentoo.org/glsa/201612-50
- https://www.exploit-db.com/exploits/38192/