|
Description
|
|
A security issue and multiple vulnerabilities have been reported in Openfire, which can be exploited by malicious people to conduct spoofing and cross-site scripting attacks and disclose potentially sensitive information.
1) Input passed via the "participant1", "participant2", "startDate", "endDate", and "keywords" GET parameters to /plugins/monitoring/archive-search.jsp (when "submitForm" is set to "Search") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) An error when handling SSL certificates can be exploited to cause the server to accept a self-signed certificate.
3) The product bundles a vulnerable version of Jetty.
For more information:
SA62970
The security issue and vulnerabilities are reported in version 3.9.3. Other versions may also be affected.
|
