The remote host is affected by the vulnerability described in GLSA-200904-01 (Openfire: Multiple vulnerabilities)

    Two vulnerabilities have been reported by Federico Muttis, from CORE     IMPACT's Exploit Writing Team:
    Multiple missing or incomplete input validations in several .jsps     (CVE-2009-0496).
    Incorrect input validation of the 'log' parameter in log.jsp     (CVE-2009-0497).
    Multiple vulnerabilities have been reported by Andreas Kurtz:
    Erroneous built-in exceptions to input validation in login.jsp     (CVE-2008-6508).
    Unsanitized user input to the 'type' parameter in     sipark-log-summary.jsp used in SQL statement. (CVE-2008-6509)     A Cross-Site-Scripting vulnerability due to unsanitized input to the     'url' parameter. (CVE-2008-6510, CVE-2008-6511)   Impact :

    A remote attacker could execute arbitrary code on clients' systems by     uploading a specially crafted plugin, bypassing authentication.
    Additionally, an attacker could read arbitrary files on the server or     execute arbitrary SQL statements. Depending on the server's     configuration the attacker might also execute code on the server via an     SQL injection.
  Workaround :

    There is no known workaround at this time.

リモートホストは、XMPPプロトコルをサポートするインスタントメッセージングサーバーであるOpenfire/Wildfireを実行しています。

そのバージョンによると、OpenfireまたはWildfireのインストールは、複数の脆弱性の影響を受けます：

  - 複数の.jspスクリプト、つまり、「logviewer.jsp」（BID 32935）、「group-summary.jsp」（BID 32937）、「user-properties.jsp」（BID 32938）、「audit-policy.jsp」（BID） 32939）、および「log.jsp」（BID 32940）は、許可されたユーザーから提供された入力のサニタイズに失敗するため、クロスサイトスクリプティングの脆弱性の影響を受けます。

  - 管理者のブラウザセッションで任意のJavaScriptを実行でき、攻撃者がセッションcookieを盗むことができる場合は、攻撃者が、新しいサーバープラグインをアップロードすることで、リモートシステムで任意のコードを実行する可能性があります。

  - ページの「security-audit-viewer.jsp」、「server-properties.js」（BID 32943）、および「muc-room-summary.jsp」（BID 32944）は、保存されたクロスサイトスクリプティングの脆弱性の影響を受けます。（BID 32943）

  - log.jspは、許可されたユーザーによって「log」パラメーターに渡された入力のサニタイズに失敗するため、認証された攻撃者が、任意の.logファイルを読み取る可能性があります。（BID 32945）

遠端主機正在執行 Openfire/Wildfire，這是一個支援 XMPP 通訊協定的即時訊息伺服器。

根據其版本，Openfire 或 Wildfire 的安裝受到多個弱點影響：

  - 多個 .jsp 指令碼，即「logviewer.jsp」(BID 32935)、「group-summary.jsp」(BID 32937)、「user-properties.jsp」(BID 32938)、「audit-policy.jsp」(BID) 32939) 和「log.jsp」(BID 32940) 無法清除授權使用者提供的輸入，因此會受到跨網站指令碼弱點影響。

  - 若版本允許系統管理員的瀏覽器工作階段執行任意 Javascript，且攻擊者已成功竊取工作階段 Cookie，攻擊者便可能透過上傳新的伺服器外掛程式，在遠端系統上執行任意程式碼。

  - Pages「security-audit-viewer.jsp」、「server-properties.js」(BID 32943) 和「muc-room-summary.jsp」(BID 32944) 會受到一個已儲存跨網站指令碼弱點影響。(BID 32943)

  - log.jsp 無法清除授權使用者傳遞至 'log' 參數的輸入，因此，經過驗證的攻擊者可能讀取任意 .log 檔案。(BID 32945)

Core Security Technologies reports :

Multiple cross-site scripting vulnerabilities have been found which may lead to arbitrary remote code execution on the server running the application due to unauthorized upload of Java plugin code.

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol.

According to its version, the installation of Openfire or Wildfire is affected by multiple vulnerabilities :

  - Multiple .jsp scripts namely, 'logviewer.jsp'     (BID 32935), 'group-summary.jsp' (BID 32937),     'user-properties.jsp' (BID 32938), 'audit-policy.jsp'     (BID 32939) and 'log.jsp' (BID 32940) fail to sanitize     input supplied by authorized users, and hence are     affected by cross-site scripting vulnerabilities.

  - Provided an administrator's browser session is allowed     to execute arbitrary Javascript and an attacker has     managed to steal session cookies, it may be possible     for an attacker to execute arbitrary code on the remote     system by uploading a new server plugin.

  - Pages 'security-audit-viewer.jsp',     'server-properties.js'     (BID 32943) and 'muc-room-summary.jsp' (BID 32944) are     affected by a stored cross-site scripting     vulnerabilities. (BID 32943)

  - log.jsp fails to sanitize input passed to the 'log'     parameter by an authorized user, and hence it may be     possible for an authenticated attacker to read arbitrary     .log files. (BID 32945)

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol.  According to its version, the installation of Openfire or Wildfire is affected by multiple vulnerabilities : 

  - Multiple .jsp scripts namely, 'logviewer.jsp' (BID 32935), 'group-summary.jsp' (BID 32937), 'user-properties.jsp' (BID 32938), 'audit-policy.jsp' (BID 32939) and 'log.jsp' (BID 32940) fail to sanitize input supplied by authorized users, and hence are affected by cross-site scripting vulnerabilities.

  - Provided an administrator's browser session is allowed to execute arbitrary JavaScript and an attacker has managed to steal session cookies, it may be possible for an attacker to execute arbitrary code on the remote system by uploading a new server plugin.

  - Pages 'security-audit-viewer.jsp', 'server-properties.js' (BID 32943) and 'muc-room-summary.jsp' (BID 32944) are affected by a stored cross-site scripting vulnerabilities. (BID 32943)

  - log.jsp fails to sanitize input passed to the 'log' parameter by an authorized user, and hence it may be possible for an authenticated attacker to read arbitrary .log files. (BID 32945).

ID	名前	製品	ファミリー	公開日	更新日	深刻度
36078	GLSA-200904-01 : Openfire: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/4/3	2021/1/6	high
35628	Openfire < 3.6.3の複数の脆弱性	Nessus	CGI abuses	2009/2/9	2021/1/19	medium
35628	Openfire < 3.6.3 多個弱點	Nessus	CGI abuses	2009/2/9	2021/1/19	medium
35458	FreeBSD : openfire -- multiple vulnerabilities (c3aba586-ea77-11dd-9d1e-000bcdc1757a)	Nessus	FreeBSD Local Security Checks	2009/1/26	2021/1/6	medium
35628	Openfire < 3.6.3 Multiple Vulnerabilities	Nessus	CGI abuses	2009/2/9	2021/1/19	medium
4925	Openfire < 3.6.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2009/2/11	2019/3/6	high

検出

プラグインの検索

high

medium

medium

medium

medium

high