CVE-2018-11688: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
(updated )
Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
References
- packetstormsecurity.com/files/148057/Ignite-Realtime-Openfire-3.7.1-Cross-Site-Scripting.html
- seclists.org/fulldisclosure/2018/Jun/13
- seclists.org/fulldisclosure/2018/Jun/24
- www.securityfocus.com/archive/1/542060/100/0/threaded
- github.com/advisories/GHSA-jphj-5g3m-w7x6
- github.com/igniterealtime/Openfire/commit/ed3492a24274fd454afe93a499db49f3d6335108
- github.com/igniterealtime/Openfire/compare/v3.9.1...v3.9.2
- nvd.nist.gov/vuln/detail/CVE-2018-11688
- vulmon.com/vulnerabilitydetails?qid=CVE-2018-11688
Code Behaviors & Features
Detect and mitigate CVE-2018-11688 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →