CVE-2019-25390: Smoothwall Express 3.1 'interfaces.cgi' Cross-Site Scripting
Smoothwall Express 3.1-SP4-polar-x8664-update9 contains multiple reflected cross-site scripting vulnerabilities in the interfaces.cgi script that allow attackers to inject malicious scripts through multiple parameters including GREENADDRESS, GREENNETMASK, REDDHCPHOSTNAME, REDADDRESS, DNS1OVERRIDE, DNS2OVERRIDE, REDMAC, REDNETMASK, DEFAULTGATEWAY, DNS1, and DNS2. Attackers can craft POST requests to interfaces.cgi with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25390?
CVE-2019-25390 is considered a medium severity vulnerability due to its impact on user data through cross-site scripting.
How do I fix CVE-2019-25390?
To fix CVE-2019-25390, ensure you are running the latest version of Smoothwall Express that addresses these vulnerabilities.
What type of vulnerability is CVE-2019-25390?
CVE-2019-25390 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages.
Which versions of Smoothwall are affected by CVE-2019-25390?
Smoothwall Express 3.1-SP4-polar-x86_64-update9 is affected by CVE-2019-25390.
How can attackers exploit CVE-2019-25390?
Attackers can exploit CVE-2019-25390 by injecting malicious JavaScript through certain parameters in the interfaces.cgi script.