CVE-2020-24604
Last modified
CVE-2020-24604 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in server-properties.jsp and security-audit-viewer.jsp. EPSS estimates a 1.17% chance of exploitation in the next 30 days.
Description
A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in server-properties.jsp and security-audit-viewer.jsp
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Igniterealtime | Openfire | 4.5.1 |
References
- https://cybersecurityworks.com/zerodays/cve-2020-24604-ignite-realtime-openfire.htmlExploit, Third Party Advisory
- https://issues.igniterealtime.org/browse/OF-1963Vendor Advisory
- https://cybersecurityworks.com/zerodays/cve-2020-24604-ignite-realtime-openfire.htmlExploit, Third Party Advisory
- https://issues.igniterealtime.org/browse/OF-1963Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-24604?
How severe is CVE-2020-24604?
How do I fix CVE-2020-24604?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-24595Mitel MiCloud Management Portal before 6.1 SP5 could allow a…5.3
- CVE-2020-24598An issue was discovered in Joomla! before 3.9.21. Lack of in…6.1
- CVE-2020-24599An issue was discovered in Joomla! before 3.9.21. Lack of es…6.1
- CVE-2020-24600Shilpi CAPExWeb 1.1 allows SQL injection via a servlet/capex…9.8
- CVE-2020-24601In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulner…6.1
- CVE-2020-24602Ignite Realtime Openfire 4.5.1 has a reflected Cross-site sc…6.1
- CVE-2020-24606Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer…7.5
- CVE-2020-24609TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and ear…6.1
- CVE-2020-24612An issue was discovered in the selinux-policy (aka Reference…4.7
- CVE-2020-24613wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the W…6.8
- CVE-2020-24614Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x befor…8.8
- CVE-2020-24615Pexip Infinity before 24.1 has Improper Input Validation, le…5.3
Are you affected by CVE-2020-24604?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST