CVE-2019-25395

Description

Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attackers to inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Attackers can submit POST requests with script payloads to preferences.cgi to store malicious code that executes in the browsers of users accessing the preferences page.

References

https://www.vulncheck.com/advisories/smoothwall-express-preferencescgi-cross-site-scrip

https://www.exploit-db.com/exploits/46333

http://www.smoothwall.org

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4