CVE-2019-25405: Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via license_activation
Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the newLicense parameter. Attackers can send POST requests to the license activation endpoint with script payloads in the newLicense field to execute arbitrary JavaScript in administrators' browsers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25405?
CVE-2019-25405 is classified as a medium severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2019-25405?
To fix CVE-2019-25405, it is recommended to update to the latest version of Comodo Dome Firewall that addresses this vulnerability.
What impact does CVE-2019-25405 have on users?
CVE-2019-25405 may allow attackers to execute malicious scripts in the context of users' browsers, compromising user data and security.
What version of Comodo Dome Firewall is affected by CVE-2019-25405?
CVE-2019-25405 affects Comodo Dome Firewall version 2.7.0.
Is CVE-2019-25405 a remote or local attack?
CVE-2019-25405 can be exploited remotely through crafted POST requests.