What this actually is.
Technical background, root cause, and affected surface.
A cross-site scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted web site. The application targets your application’s users and not the application itself, but it uses your application as the vehicle for the attack. XSS payload is executed whenever the user submits the crafted POST request with XSS Payload in Openfire 4.4.4 Product.
- Vendor
- Openfire
- Affected Product
- Ignite Realtime
- CVE
- CVE-2019-20364
- Securin ID
- 2019-CSW-12-1034
- Status
- Fixed
- Date
- December 31, 2019
- Severity
- Medium
- CVSS Score
- 6.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Stealing cookies
End-user files disclosure.
Redirection of the user to some other page or site.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Perform context-sensitive encoding of untrusted input before it is echoed back to a browser by using an encoding library. Implement input validation for special characters on all the variables that are reflecting to the browser and storing it in the database. Implement client-side validation.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vulnerability Discovered in OpenFire
Vulnerability Reported to Vendor
Vendor Responded
Vendor Released Fix
CVE Assigned
Disclosed 1 day after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.