Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the…

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.

Scores

EPSS (exploitation in 30 days)

64.8% · top 0.8% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

• n/a
• CWE-352 (opens in a new tab)All about CWE-352 and its CVEs

Affected products

• n/a

  • affected n/a

References (5)

• 20150915 Openfire 3.10.2 CSRF Vulnerabilities (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• GLSA-201612-50 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• http://packetstormsecurity.com/files/133554/Openfire-3.10.2-Cross-Site-Request-Forgery.html (opens in a new tab)x_refsource_MISCx_transferred
• http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt (opens in a new tab)x_refsource_MISCx_transferred
• 38192 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2015-6973](https://trackcve.app/badge/CVE-2015-6973.svg)](https://trackcve.app/cve/CVE-2015-6973)

Record last updated 6 Aug 2024, 07:36 UTC.