CVE-2020-35200: 
Openfire vulnerability analysis and mitigation

Ignite Realtime Openfire 4.6.0 contains a Reflective Cross-Site Scripting (XSS) vulnerability in the plugins/clientcontrol/spark-form.jsp component. This vulnerability was discovered and disclosed on December 11, 2020 (Ignite Forum).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue, specifically an Improper Neutralization of Input During Web Page Generation. According to the National Vulnerability Database, this vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (NVD).

A successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to the disclosure of sensitive information, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and integrity with low impact, while availability is not affected (NVD).

The vulnerability is remotely exploitable without requiring authentication. It requires user interaction (UI:R in CVSS score) to be successfully exploited, as the victim needs to interact with a malicious payload (NVD).

Users should upgrade to a patched version of Openfire if available. As this is a Reflective XSS vulnerability, implementing proper input validation and output encoding for the affected component (spark-form.jsp) would help mitigate the risk (Ignite Forum).