CVE-2019-25369: OPNsense 19.1 Stored XSS via system_advanced_sysctl.php
OPNsense 19.1 contains a stored cross-site scripting vulnerability in the systemadvancedsysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. Attackers can submit POST requests with script payloads that are stored and executed in the context of authenticated user sessions when the page is viewed.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25369?
CVE-2019-25369 has been categorized as a medium severity vulnerability due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2019-25369?
To fix CVE-2019-25369, update your OPNsense installation to the latest version where this vulnerability has been addressed.
What systems are affected by CVE-2019-25369?
CVE-2019-25369 affects OPNsense version 19.1 specifically.
Can CVE-2019-25369 lead to data compromise?
Yes, CVE-2019-25369 can potentially allow attackers to inject scripts, leading to data compromise or unauthorized access.
What type of attack does CVE-2019-25369 enable?
CVE-2019-25369 enables stored cross-site scripting (XSS) attacks that can affect users who access the compromised endpoint.