CVE-2019-25382: Smoothwall Express 3.1 'time.cgi' Cross-Site Scripting
Smoothwall Express 3.1-SP4-polar-x8664-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the NTPSERVER parameter. Attackers can send POST requests to the time.cgi endpoint with script payloads in the NTPSERVER parameter to execute arbitrary JavaScript in users' browsers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25382?
CVE-2019-25382 is classified as a high-severity vulnerability due to its potential for exploitation via reflected cross-site scripting.
How do I fix CVE-2019-25382?
To fix CVE-2019-25382, update to the latest version of Smoothwall Express that addresses this vulnerability.
Who is affected by CVE-2019-25382?
CVE-2019-25382 affects users of Smoothwall Express 3.1 and its specific updates.
What type of attacks can CVE-2019-25382 allow?
CVE-2019-25382 can allow unauthenticated attackers to inject malicious scripts into web applications.
Is CVE-2019-25382 a known vulnerability?
Yes, CVE-2019-25382 is a publicly disclosed vulnerability with documented exploitation methods.