CVE-2019-25387: Smoothwall Express 3.1 'xtaccess.cgi' Cross-Site Scripting
Smoothwall Express 3.1-SP4-polar-x8664-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the xtaccess.cgi endpoint. Attackers can inject script payloads through the EXT, DESTPORT, or COMMENT parameters via POST requests to execute arbitrary JavaScript in victim browsers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25387?
CVE-2019-25387 has been classified with a medium severity due to its potential for allowing cross-site scripting attacks.
How do I fix CVE-2019-25387?
To fix CVE-2019-25387, you should update to the latest version of Smoothwall Express that addresses this vulnerability.
Who is affected by CVE-2019-25387?
CVE-2019-25387 affects users of Smoothwall Express 3.1-SP4-polar-x86_64-update9.
What can attackers do with CVE-2019-25387?
Attackers can exploit CVE-2019-25387 to execute arbitrary JavaScript in the context of the user's browser session.
Is authentication required to exploit CVE-2019-25387?
No, CVE-2019-25387 can be exploited by unauthenticated attackers.