{"id":"CVE-2019-20528","published":"2020-03-18T18:36:38Z","modified":"2024-08-05T02:46:09Z","title":"Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter","vendor":null,"product":null,"tier":"tail","description":{"text":"Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00906,"percentile":0.59743,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.netsparker.com/web-applications-advisories/ns-19-015-reflected-cross-site-scripting-in-openfire/","tags":["x_refsource_MISC"]}],"priority":{"score":11.9,"factors":[{"name":"EPSS percentile","points":11.95}]},"affected":[{"ecosystem":"Maven","package":"org.igniterealtime.openfire:xmppserver","vulnerableRanges":["<4.4.2"],"patched":["4.4.2"],"from":["GHSA-wx2w-8pqw-vp4g"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5663","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-15488","published":"2019-08-23","fixed":"4.4.1","kev":false,"link":{"from":"CVE-2019-15488","to":"CVE-2019-20528","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.igniterealtime.openfire:xmppserver","fromFixed":"4.4.1","toFixed":"4.4.2","daysApart":208}]}},{"cve":"CVE-2019-20528","published":"2020-03-18","fixed":"4.4.2","kev":false},{"cve":"CVE-2023-32315","published":"2023-05-26","fixed":"4.7.5","kev":true},{"cve":"CVE-2024-25420","published":"2024-03-26","fixed":"4.8.1","kev":false},{"cve":"CVE-2024-25421","published":"2024-03-26","fixed":"4.8.1","kev":false}],"package":"Maven:org.igniterealtime.openfire:xmppserver"}}