CVE-2019-25407

Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupschedule

CVSS 5.1 MEDIUMEPSS 0.4%CWE-79

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the backup schedule interface. Attackers can send POST requests to the backupschedule endpoint with JavaScript code in the BACKUP_RCPTTO parameter to execute arbitrary scripts in users' browsers.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

Comodo · Comodo Dome Firewall

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://cdome.comodo.com/firewall/https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278 https://www.exploit-db.com/exploits/46408 https://www.vulncheck.com/advisories/comodo-dome-firewall-cross-site-scripting-via-backupschedule