CVE-2019-25376: falha de média gravidade em OPNsense
OPNsense 19.1 Reflected XSS via proxy endpoint
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.4%
probabilidade de exploração
0.4%top 69% das CVEs
exploração observada
nãonenhuma fonte reporta
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. Attackers can send POST requests to the proxy endpoint with JavaScript code in the ignoreLogACL parameter to execute arbitrary scripts in users' browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Opnsense · OPNsenseCVEs relacionadas — OPNsense
No mesmo produto, das mais perigosas para as menos.
CVE-2019-25375MEDIUMOPNsense 19.1 Reflected XSS via monit interfaceEPSS 0.4%CVE-2019-25374MEDIUMOPNsense 19.1 Reflected XSS via vpn_ipsec_settings.phpEPSS 0.3%CVE-2019-25377MEDIUMOPNsense 19.1 Reflected XSS via system_advanced_sysctl.phpEPSS 0.3%CVE-2019-25372MEDIUMOPNsense 19.1 Reflected XSS via diag_traceroute.phpEPSS 0.3%CVE-2019-25371MEDIUMOPNsense 19.1 Reflected XSS via diag_ping.phpEPSS 0.3%CVE-2019-25370MEDIUMOPNsense 19.1 Reflected XSS via interfaces_vlan_edit.phpEPSS 0.2%