CVE-2020-24604: Cross-site Scripting

September 2, 2020 (updated November 10, 2020)

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request searchName, searchValue, searchDescription, searchDefaultValue,searchPlugin, searchDescription and searchDynamic in server-properties.jsp and security-audit-viewer.jsp

References

issues.igniterealtime.org/browse/OF-1963
nvd.nist.gov/vuln/detail/CVE-2020-24604

Detect and mitigate CVE-2020-24604 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →