CVE-2019-25372: OPNsense 19.1 Reflected XSS via diag_traceroute.php
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted payloads through POST requests to diagtraceroute.php to execute arbitrary JavaScript in the context of a user's browser session.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25372?
CVE-2019-25372 is classified as a reflected cross-site scripting vulnerability that can allow malicious script injection.
How do I fix CVE-2019-25372?
To mitigate CVE-2019-25372, ensure that input validation in the host parameter of diag_traceroute.php is properly implemented.
Who is affected by CVE-2019-25372?
CVE-2019-25372 affects users of OPNsense version 19.1 who have not implemented sufficient input validation.
What type of attack can be executed using CVE-2019-25372?
CVE-2019-25372 enables unauthenticated attackers to execute reflected XSS attacks on vulnerable systems.
Can CVE-2019-25372 be exploited remotely?
Yes, CVE-2019-25372 can be exploited remotely since it does not require authentication to execute the attack.