CVE-2019-25369: medium-severity vulnerability in OPNsense
OPNsense 19.1 Stored XSS via system_advanced_sysctl.php
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.2%
exploitation probability
0.2%top 89% of all CVEs
observed exploitation
nono source reports it
OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. Attackers can submit POST requests with script payloads that are stored and executed in the context of authenticated user sessions when the page is viewed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
Opnsense · OPNsenseRelated CVEs — OPNsense
In the same product, most dangerous first.
CVE-2019-25376MEDIUMOPNsense 19.1 Reflected XSS via proxy endpointEPSS 0.4%CVE-2019-25375MEDIUMOPNsense 19.1 Reflected XSS via monit interfaceEPSS 0.4%CVE-2019-25374MEDIUMOPNsense 19.1 Reflected XSS via vpn_ipsec_settings.phpEPSS 0.3%CVE-2019-25377MEDIUMOPNsense 19.1 Reflected XSS via system_advanced_sysctl.phpEPSS 0.3%CVE-2019-25372MEDIUMOPNsense 19.1 Reflected XSS via diag_traceroute.phpEPSS 0.3%CVE-2019-25371MEDIUMOPNsense 19.1 Reflected XSS via diag_ping.phpEPSS 0.3%