CVE
CVE-2019-25387
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the xtaccess.cgi endpoint. Attackers can inject script payloads through the EXT, DEST_PORT, or COMMENT parameters via POST requests to execute arbitrary JavaScript in victim browsers.
- Severity
- MEDIUM
- CVSS
- 5.1
- Published
- Modified
Linked Releases
| Distribution | Release | Status | Evidence |
|---|---|---|---|
| SmoothWall Express | 3.1 x86_64 express standard | unknown | source |
| SmoothWall Express | 3.1 x86_64 express offroad | unknown | source |
| SmoothWall Express | 3.1 x86_64 express dev | unknown | source |
| SmoothWall Express | 3.1 i586 express standard | unknown | source |
| SmoothWall Express | 3.1 i586 express offroad | unknown | source |
| SmoothWall Express | 3.1 i586 express dev | unknown | source |