CVE-2019-25383: Smoothwall Express 3.1 'apcupsd.cgi' Cross-Site Scripting
Smoothwall Express 3.1-SP4-polar-x8664-update9 contains multiple reflected cross-site scripting vulnerabilities in the apcupsd.cgi script that allow attackers to inject malicious scripts through multiple POST parameters. Attackers can submit crafted POST requests with script payloads in parameters like BATTLEVEL, RTMIN, BATTDELAY, TO, ANNOY, UPSIP, UPSNAME, UPSPORT, POLLTIME, UPSUSER, NISPORT, UPSAUTH, EMAIL, FROM, CC, SMSEMAIL, SMTPSERVER, PORT, USER, and EMAILPASSWORD to execute arbitrary JavaScript in victim browsers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25383?
CVE-2019-25383 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2019-25383?
To fix CVE-2019-25383, update to the latest version of Smoothwall Express that addresses the reflected cross-site scripting vulnerabilities.
What software is affected by CVE-2019-25383?
CVE-2019-25383 affects Smoothwall Express 3.1 versions, specifically the apcupsd.cgi script.
What type of vulnerability is CVE-2019-25383?
CVE-2019-25383 is a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts.
What can attackers do with CVE-2019-25383?
Attackers can exploit CVE-2019-25383 to inject and execute malicious scripts via multiple POST parameters.