OpenFire versions 3.10.2 through 4.0.1 suffer from cross site request forgery and cross site scripting vulnerabilities. These issues are similar as findings discovered by hyp3rlinx but leverage different pages.
be513ac2a1d466d9fc24adcadf3d11b3c22f9970e5d75746d50da08647e6334e