What’s Vulnerable › Vulnerabilities

CVE-2020-24601

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-09-02 · updated 2026-06-17
• Weakness: CWE-79

Description

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page

Affected products

• igniterealtime Openfire: 4.5.1

References

• https://cybersecurityworks.com/zerodays/cve-2020-24601-ignite-realtime-openfire.html
• https://issues.igniterealtime.org/browse/OF-1963
• https://cybersecurityworks.com/zerodays/cve-2020-24601-ignite-realtime-openfire.html
• https://issues.igniterealtime.org/browse/OF-1963

Get alerted when CVE-2020-24601 or the next vulnerability affects your stack