CVE-2019-25388: medium-severity vulnerability in Smoothwall Express
Smoothwall Express 3.1 'ipblock.cgi' Cross-Site Scripting
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.3%
exploitation probability
0.3%top 84% of all CVEs
observed exploitation
nono source reports it
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the ipblock.cgi endpoint. Attackers can inject script tags through the SRC_IP and COMMENT parameters in POST requests to execute arbitrary JavaScript in users' browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
Smoothwall · Smoothwall ExpressRelated CVEs — Smoothwall Express
In the same product, most dangerous first.
CVE-2011-1084—CVE-2011-1084EPSS 0.6%CVE-2011-1085—CVE-2011-1085EPSS 0.5%CVE-2019-25382MEDIUMSmoothwall Express 3.1 'time.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2019-25379MEDIUMSmoothwall Express 3.1 'urlfilter.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2019-25392MEDIUMSmoothwall Express 3.1 'iptools.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2019-25389MEDIUMSmoothwall Express 3.1 'timedaccess.cgi' Cross-Site ScriptingEPSS 0.3%