This host is running Openfire and is prone to multiple vulnerabilities.

Successful exploitation will let the attacker cause multiple attacks in the context of the application i.e. Cross site scripting, disclosure of sensitive information, phishing attacks through the affected parameters. Impact level: Application/Network

Upgrade to the version 3.6.1 or later. http://www.igniterealtime.org/downloads/index.jsp

Multiple flaws are due to, - error in the AuthCheckFilter which causes access to administrative resources without admin authentication. - error in the type parameter inside the file 'sipark-log-summary.jsp' which causes SQL Injection attack. - error in the 'login.jsp' URL parameter which accept malicious chars as input which causes XSS attack. - error in the SIP-Plugin which is deactivated by default which lets the attack install the plugin by using admin authentication bypass methods.

Openfire version prior to 3.6.1

• http://secunia.com/advisories/32478
• http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
• http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html

---

Updated on 2017-03-28