Hi,
This is regarding multiple CSRF (Cross Site Request Forgery)
Vulnerabilities in Openfire 3.6.4 Administrative Section. The following
is the disclosure document:
–
–
–
–
–
Vulnerability Details:
An attacker can execute functions as an authenticated user by tricking a
user into making requests to the Server. The attack works by including a
link or script in a page that accesses a site to which the user is known
(or is supposed) to have been authenticated. Successful exploitation of
these vulnerabilities could result in, but not limited to, compromise of
the application, theft of cookie-based authentication credentials,
arbitrary page redirection, disclosure or modification of sensitive data
and phishing attacks.
–
–
Warm Regards,
Riyaz Ahemed Walikar || Senior Engineer - Professional Services
Vulnerability Assessment & Penetration Testing
Microland Limited
www.microland.com
The information transmitted is intended only for the person or entity to which it
is addressed and may contain confidential and/or privileged material.
Any review, re-transmission, dissemination or other use of or taking of any action
in reliance upon,this information by persons or entities other than the intended
recipient is prohibited.
If you received this in error, please contact the sender and delete the material
from your computer.
Microland takes all reasonable steps to ensure that its electronic communications
are free from viruses.
However, given Internet accessibility, the Company cannot accept liability for any
virus introduced by this e-mail or any attachment and you are advised to use
up-to-date virus checking software.