medium6.1
CVE-2019-20525
Ignite Realtime Openfire allows Cross-site Scripting
Impact
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. This issue was fixed in version 4.4.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.igniterealtime.openfire:parent | < 4.4.2 | 4.4.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Igniterealtime | Openfire | Version 4.4.1 |