The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary…
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.
Why it matters now
EPSS 0.00728 54th percentileScored 2026-11-07
Fix Fixed org.igniterealtime.openfire:parent (Maven): 4.1.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.igniterealtime.openfire:parent (Maven) | before 4.1.7 | 4.1.7 | Patch available | GHSA-v3h2-4j2r-wqj8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.igniterealtime.openfire:parent (Maven) Vendor— Affected before 4.1.7 Fixed in 4.1.7 Patch available GHSA-v3h2-4j2r-wqj8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:* | up to 4.1.6 | Vulnerable | igniterealtime |
- cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:* Versions up to 4.1.6 Vulnerable ·igniterealtime
Remediation
- Fix · GHSA-v3h2-4j2r-wqj8 org.igniterealtime.openfire:parent (Maven) Fixed in 4.1.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15911
- 2026-10-03 Alias added: GHSA-v3h2-4j2r-wqj8
References
More igniterealtime Openfire vulnerabilities
- TI-2023-15609 Openfire administration console authentication bypass KEVCVSS 3.1HIGH 8.6
- TI-2024-16737 An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2021-20964 An issue was discovered in Pascom Cloud Phone System before 7.20.x. CVSS 3.1CRITICAL 9.8
- TI-2008-06198 Directory traversal vulnerability in the AuthCheck filter in the Admin Console in… CVSS 2.0HIGH 7.5
- TI-2024-16736 An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate… CVSS 3.1HIGH 7.2
- TI-2019-13396 A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-15911 · CVE Program
- CVE-2017-15911 · NVD
- FIRST EPSS
- GHSA-v3h2-4j2r-wqj8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences