Unscored severity · published Mar 23, 2009
CVE-2008-6510
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openfire · Igniterealtime
through 3.6.0a; 2.6.0; 2.6.1; 2.6.2; 3.0.0; 3.0.1; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6510
Exploit
http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
www.igniterealtime.org
http://www.igniterealtime.org/issues/browse/JM-629
www.securityfocus.com
http://www.securityfocus.com/archive/1/498162/100/0/threaded
Exploit
http://www.securityfocus.com/bid/32189
Vendor Advisory
http://www.vupen.com/english/advisories/2008/3061
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/46486
More from Openfire
7.5
CVE-2023-32315
Openfire administration console authentication bypass
9.8
CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component
9.8
CVE-2021-45967
An issue was discovered in Pascom Cloud Phone System before 7.20.x
9.8
CVE-2019-18394
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests
7.5
CVE-2014-3451
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks