CVE-2019-25377: falha de média gravidade em OPNsense
OPNsense 19.1 Reflected XSS via system_advanced_sysctl.php
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.3%
probabilidade de exploração
0.3%top 84% das CVEs
exploração observada
nãonenhuma fonte reporta
OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. Attackers can craft POST requests with script payloads in the value parameter to execute JavaScript in the context of authenticated user sessions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Opnsense · OPNsenseCVEs relacionadas — OPNsense
No mesmo produto, das mais perigosas para as menos.
CVE-2019-25376MEDIUMOPNsense 19.1 Reflected XSS via proxy endpointEPSS 0.4%CVE-2019-25375MEDIUMOPNsense 19.1 Reflected XSS via monit interfaceEPSS 0.4%CVE-2019-25374MEDIUMOPNsense 19.1 Reflected XSS via vpn_ipsec_settings.phpEPSS 0.3%CVE-2019-25372MEDIUMOPNsense 19.1 Reflected XSS via diag_traceroute.phpEPSS 0.3%CVE-2019-25371MEDIUMOPNsense 19.1 Reflected XSS via diag_ping.phpEPSS 0.3%CVE-2019-25370MEDIUMOPNsense 19.1 Reflected XSS via interfaces_vlan_edit.phpEPSS 0.2%