CVE-2019-25407: medium-severity vulnerability in Comodo Dome Firewall
Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupschedule
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.5%
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the backup schedule interface. Attackers can send POST requests to the backupschedule endpoint with JavaScript code in the BACKUP_RCPTTO parameter to execute arbitrary scripts in users' browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Comodo · Comodo Dome FirewallRelated CVEs — Comodo Dome Firewall
In the same product, most dangerous first.
CVE-2019-25427MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via antispywareEPSS 0.5%CVE-2019-25423MEDIUMComodo Dome Firewall 2.7.0 Cross-Site Scripting via proxyconfigEPSS 0.5%CVE-2019-25421MEDIUMComodo Dome Firewall 2.7.0 Cross-Site Scripting via policyfwEPSS 0.5%CVE-2019-25420MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via snatEPSS 0.5%CVE-2019-25417MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS RulesEPSS 0.5%CVE-2019-25429MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via openvpn_advancedEPSS 0.4%