CVE-2019-15488 (NVD)

2019-08-23

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

Products Openfire
Type Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
First patch - None (likely due to unavailable code)
Links https://github.com/igniterealtime/Openfire/pull/1441
https://github.com/igniterealtime/Openfire/compare/cd0a573...5e5d9e5