Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2020-24602: Openfire Server: Malicious URL Execution via Search Parameter
CVE-2020-24602 · published 6 years ago
Summary
An attacker can trick users into visiting a malicious website by manipulating the search parameters in Openfire's Server Properties and Security Audit Viewer pages. This can lead to the execution of arbitrary malicious URLs. To protect your server, ensure you update to a patched version of Openfire.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| igniterealtime | openfire |
4.5.1 cpe:2.3:a:igniterealtime:openfire:4.5.1:*:*:*:*:*:*:* |
Original advisory text
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchVa...
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in the Server Properties and Security Audit Viewer JSP page
References
- https://cybersecurityworks.com/zerodays/cve-2020-24602-ignite-realtime-openfire.... Exploit Third Party Advisory
- https://issues.igniterealtime.org/browse/OF-1963 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Sep 2020
Updated31 Oct 2026
First seen9 Jul 2026
Track software like this
Free during beta