CVE-2019-25393: falha de média gravidade em Smoothwall Express
Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
probabilidade de exploração
0.2%top 85% das CVEs
exploração observada
nãonenhuma fonte reporta
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation. Attackers can submit POST requests to the smoothinfo.cgi endpoint with script payloads in the WRAP or SECTIONTITLE parameters to execute arbitrary JavaScript in victim browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Smoothwall · Smoothwall ExpressCVEs relacionadas — Smoothwall Express
No mesmo produto, das mais perigosas para as menos.
CVE-2011-1084—CVE-2011-1084EPSS 0.6%CVE-2011-1085—CVE-2011-1085EPSS 0.5%CVE-2019-25382MEDIUMSmoothwall Express 3.1 'time.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2019-25379MEDIUMSmoothwall Express 3.1 'urlfilter.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2019-25392MEDIUMSmoothwall Express 3.1 'iptools.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2019-25389MEDIUMSmoothwall Express 3.1 'timedaccess.cgi' Cross-Site ScriptingEPSS 0.3%