Test ID:	1.3.6.1.4.1.25623.1.0.800354
Category:	Web application abuses
Title:	OpenFire < 3.6.3 Multiple Vulnerabilities
Summary:	OpenFire is prone to multiple vulnerabilities.
Description:	Summary: OpenFire is prone to multiple vulnerabilities. Vulnerability Insight: Application fails to sanitise the user inputs in: - log parameter to logviewer.jsp and log.jsp files - search parameter to group-summary.jsp file - username parameter to user-properties.jsp file - logDir, maxTotalSize, maxFileSize, maxDays, and logTimeout parameters to audit-policy.jsp file - propName parameter to server-properties.jsp file - roomconfig_roomname and roomconfig_roomdesc parameters to muc-room-edit-form.jsp file Vulnerability Impact: Attacker may leverage this issue by executing arbitrary script code or injecting HTML or JavaScript code in the context of the affected system and can cause directory traversal or XSS attack. Affected Software/OS: Openfire prior to version 3.6.3. Solution: Update to version 3.6.3 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0496 BugTraq ID: 32935 http://www.securityfocus.com/bid/32935 BugTraq ID: 32937 http://www.securityfocus.com/bid/32937 BugTraq ID: 32938 http://www.securityfocus.com/bid/32938 BugTraq ID: 32939 http://www.securityfocus.com/bid/32939 BugTraq ID: 32940 http://www.securityfocus.com/bid/32940 BugTraq ID: 32943 http://www.securityfocus.com/bid/32943 BugTraq ID: 32944 http://www.securityfocus.com/bid/32944 Bugtraq: 20090108 CORE-2008-1128: Openfire multiple vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/499880/100/0/threaded http://www.coresecurity.com/content/openfire-multiple-vulnerabilities http://secunia.com/advisories/33452 XForce ISS Database: openfire-mucroomeditform-xss(47845) https://exchange.xforce.ibmcloud.com/vulnerabilities/47845 XForce ISS Database: openfire-multiple-scripts-xss(47834) https://exchange.xforce.ibmcloud.com/vulnerabilities/47834 XForce ISS Database: openfire-serverproperties-xss(47835) https://exchange.xforce.ibmcloud.com/vulnerabilities/47835 Common Vulnerability Exposure (CVE) ID: CVE-2009-0497 BugTraq ID: 32945 http://www.securityfocus.com/bid/32945 http://svn.igniterealtime.org/svn/repos/openfire/trunk/src/web/log.jsp https://bugs.gentoo.org/show_bug.cgi?id=257585 XForce ISS Database: openfire-log-directory-traversal(47806) https://exchange.xforce.ibmcloud.com/vulnerabilities/47806
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.