CVE
CVE-2019-25382
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the NTP_SERVER parameter. Attackers can send POST requests to the time.cgi endpoint with script payloads in the NTP_SERVER parameter to execute arbitrary JavaScript in users' browsers.
- Severity
- MEDIUM
- CVSS
- 5.1
- Published
- Modified
Linked Releases
| Distribution | Release | Status | Evidence |
|---|---|---|---|
| SmoothWall Express | 3.1 x86_64 express standard | unknown | source |
| SmoothWall Express | 3.1 x86_64 express offroad | unknown | source |
| SmoothWall Express | 3.1 x86_64 express dev | unknown | source |
| SmoothWall Express | 3.1 i586 express standard | unknown | source |
| SmoothWall Express | 3.1 i586 express offroad | unknown | source |
| SmoothWall Express | 3.1 i586 express dev | unknown | source |