CVE-2017-15911 json
Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console
published 2017-10-26 9 y ago modified 2026-06-17 4 mo ago also GHSA-v3h2-4j2r-wqj8 , EUVD-2022-5270
- cvss
- 4.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.
Patch / fix
- maven org.igniterealtime.openfire:parent 4.1.7
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.8 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.0 | 4.8 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.igniterealtime.openfire:parent | <4.1.7 |
4.1.7 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
issues.igniterealtime.org
/browse/OF-1417
web, issue-tracking, vendor-advisory
-
becomepentester.blogspot.ae
/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html
web, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-15911
advisory
Sources
- CVE List CVE-2017-15911
- GitHub Advisory GHSA-v3h2-4j2r-wqj8
- NVD CVE-2017-15911
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.