medium6.1
CVE-2019-20528
Ignite Realtime Openfire allows Cross-site Scripting
Impact
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. This issue was fixed in version 4.4.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.igniterealtime.openfire:xmppserver | < 4.4.2 | 4.4.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Igniterealtime | Openfire | Version 4.4.1 |