CVE-2019-25368: OPNsense 19.1 Reflected XSS via diag_backup.php
OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diagbackup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDriveGDriveEmail, GDriveGDriveFolderID, GDriveGDriveBackupCount, Nextcloudurl, Nextclouduser, Nextcloudpassword, Nextcloudpasswordencryption, and Nextcloudbackupdir. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25368?
CVE-2019-25368 has a medium severity rating due to its ability to allow cross-site scripting attacks.
How do I fix CVE-2019-25368?
To fix CVE-2019-25368, upgrade to a patched version of OPNsense beyond 19.1.
What parameters are affected by CVE-2019-25368?
CVE-2019-25368 affects parameters such as GDrive_GDriveEmail and GDrive_GDriveFolderID in the diag_backup.php endpoint.
Can CVE-2019-25368 be exploited remotely?
Yes, CVE-2019-25368 can be exploited remotely if the vulnerable version of OPNsense is exposed.
What is the impact of CVE-2019-25368 on users?
The impact of CVE-2019-25368 may include unauthorized script execution, potentially leading to user data theft or session hijacking.