ID de Prueba:	1.3.6.1.4.1.25623.1.0.800354
Categoría:	Web application abuses
Título:	OpenFire < 3.6.3 Multiple Vulnerabilities
Resumen:	OpenFire is prone to multiple vulnerabilities.
Descripción:	Summary: OpenFire is prone to multiple vulnerabilities. Vulnerability Insight: Application fails to sanitise the user inputs in: - log parameter to logviewer.jsp and log.jsp files - search parameter to group-summary.jsp file - username parameter to user-properties.jsp file - logDir, maxTotalSize, maxFileSize, maxDays, and logTimeout parameters to audit-policy.jsp file - propName parameter to server-properties.jsp file - roomconfig_roomname and roomconfig_roomdesc parameters to muc-room-edit-form.jsp file Vulnerability Impact: Attacker may leverage this issue by executing arbitrary script code or injecting HTML or JavaScript code in the context of the affected system and can cause directory traversal or XSS attack. Affected Software/OS: Openfire prior to version 3.6.3. Solution: Update to version 3.6.3 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0496 BugTraq ID: 32935 http://www.securityfocus.com/bid/32935 BugTraq ID: 32937 http://www.securityfocus.com/bid/32937 BugTraq ID: 32938 http://www.securityfocus.com/bid/32938 BugTraq ID: 32939 http://www.securityfocus.com/bid/32939 BugTraq ID: 32940 http://www.securityfocus.com/bid/32940 BugTraq ID: 32943 http://www.securityfocus.com/bid/32943 BugTraq ID: 32944 http://www.securityfocus.com/bid/32944 Bugtraq: 20090108 CORE-2008-1128: Openfire multiple vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/499880/100/0/threaded http://www.coresecurity.com/content/openfire-multiple-vulnerabilities http://secunia.com/advisories/33452 XForce ISS Database: openfire-mucroomeditform-xss(47845) https://exchange.xforce.ibmcloud.com/vulnerabilities/47845 XForce ISS Database: openfire-multiple-scripts-xss(47834) https://exchange.xforce.ibmcloud.com/vulnerabilities/47834 XForce ISS Database: openfire-serverproperties-xss(47835) https://exchange.xforce.ibmcloud.com/vulnerabilities/47835 Common Vulnerability Exposure (CVE) ID: CVE-2009-0497 BugTraq ID: 32945 http://www.securityfocus.com/bid/32945 http://svn.igniterealtime.org/svn/repos/openfire/trunk/src/web/log.jsp https://bugs.gentoo.org/show_bug.cgi?id=257585 XForce ISS Database: openfire-log-directory-traversal(47806) https://exchange.xforce.ibmcloud.com/vulnerabilities/47806
Copyright	Copyright (C) 2009 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.