CVE-2019-25381: Smoothwall Express 3.1 'hosts.cgi' Cross-Site Scripting
Smoothwall Express 3.1-SP4-polar-x8664-update9 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests to the hosts.cgi endpoint with script payloads in the IP, HOSTNAME, or COMMENT parameters to execute arbitrary JavaScript in users' browsers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25381?
CVE-2019-25381 has been classified as a high severity vulnerability due to its potential to allow attackers to inject malicious scripts.
How do I fix CVE-2019-25381?
To fix CVE-2019-25381, it is recommended to update Smoothwall Express to the latest version that addresses this vulnerability.
What types of attacks are possible with CVE-2019-25381?
CVE-2019-25381 enables reflected cross-site scripting attacks, allowing attackers to execute malicious scripts in users' browsers.
Which systems are affected by CVE-2019-25381?
CVE-2019-25381 affects Smoothwall Express 3.1 and its specific versions including 3.1-SP4-polar-x86_64-update9.
Are there any mitigation techniques for CVE-2019-25381?
Mitigation for CVE-2019-25381 includes input validation and proper sanitization of user input in the hosts.cgi script to prevent script injection.