CVE-2020-35201: 
Openfire vulnerability analysis and mitigation

Ignite Realtime Openfire 4.6.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the create-bookmark.jsp users parameter. The vulnerability was discovered and disclosed on December 12, 2020 (NVD, CVE).

The vulnerability exists in the create-bookmark.jsp file where user input in the 'users' parameter is not properly sanitized before being stored and rendered. The CVSS v3.1 base score is 5.4 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 base score is 3.5 (Low) with vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N) (NVD).

A successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of other users' browsers who view the stored malicious content. This could lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD).

A proof-of-concept exploit exists that demonstrates how an attacker can inject malicious JavaScript code via the 'users' parameter in the create-bookmark.jsp page. The attack requires authentication and user interaction to be successful (Exploit DB).

Users should upgrade to a patched version of Openfire when available. In the meantime, implementing proper input validation and output encoding for the 'users' parameter in create-bookmark.jsp can help mitigate this vulnerability (NVD).