XSS vulnerability in Monitoring Service pages in Admin Console
Description
In the admin panel of openfire, if you go to Archiving to start a search for a conversation you will have a url something like this:
The folowing parameters are vulnerable to Reflected XSS(Cross Site Scripting):
participant1
participant2
startDate
endDate
keywords
Environment
None
Activity
Show:
Tom Evans
October 31, 2014, 7:25 PM
Refer to PR #96.
wroot
June 17, 2015, 9:58 AM
There is a report that the issue is not fixed yet: https://community.igniterealtime.org/thread/56022
Simon Waters
December 16, 2016, 3:08 PM
Can not reproduce this in 4.1beta. The injected strings are escaped and placed in the relevant fields if you manipulate the URL.
Fixed
Assignee
Tom Evans
Reporter
wroot
Expected Effort
None
Ignite Forum URL
None
Components
Fix versions
Priority
Configure