CVE-2019-25395: Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scripting
Smoothwall Express 3.1-SP4-polar-x8664-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attackers to inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Attackers can submit POST requests with script payloads to preferences.cgi to store malicious code that executes in the browsers of users accessing the preferences page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25395?
CVE-2019-25395 is classified as a stored cross-site scripting vulnerability with a moderate severity level.
How do I fix CVE-2019-25395?
To mitigate CVE-2019-25395, update to the latest version of Smoothwall Express that addresses the cross-site scripting vulnerabilities in preferences.cgi.
What are the affected parameters in CVE-2019-25395?
CVE-2019-25395 affects the HOSTNAME, KEYMAP, and OPENNESS parameters in the preferences.cgi script.
Who is affected by CVE-2019-25395?
Users of Smoothwall Express 3.1 and its updates are affected by CVE-2019-25395.
What can attackers do with CVE-2019-25395?
Attackers can exploit CVE-2019-25395 to inject malicious scripts into web pages viewed by users of the Smoothwall Express application.