oss-security - CVE request: openfire login page XSS (JM-629)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Thu, 14 Aug 2008 13:16:10 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: openfire login page XSS (JM-629)

Hi all,

a XSS issue in login.jsp in Openfire (formerly Wildfire) up to version 
3.5.2 (latest) is currently without fix and without CVE id:
  http://www.igniterealtime.org/issues/browse/JM-629
  https://bugs.gentoo.org/show_bug.cgi?id=229515


The upstream bug report also mentions another login XSS that was fixed 
in 2005 -- http://www.igniterealtime.org/issues/browse/JM-430



Robert

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.