PT-2026-20502 · Ipfire · Ipfire

Ozer Goker · CVE-2019-25400 · Publicado 2026-02-18 · Atualizado 2026-02-18

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire version 2.21 Core Update 127

Description The software contains multiple reflected cross-site scripting issues in the fwhosts.cgi script. Attackers can inject malicious scripts through several parameters, including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp name, remark, SRV NAME, SRV PORT, SRVGRP NAME, SRVGRP REMARK, and updatesrvgrp. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated users' browsers.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all input to the fwhosts.cgi script, especially the parameters HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp name, remark, SRV NAME, SRV PORT, SRVGRP NAME, SRVGRP REMARK, and updatesrvgrp.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25400

Produtos afetados

Ipfire

Referências · 6

• 🔥 https://exploit-db.com/exploits/46344 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25400 · Aviso do Fabricante
• https://vulncheck.com/advisories/ipfire-core-update-multiple-xss-via-fwhostscgi · Nota
• https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso · Correção
• https://ipfire.org · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25400 · Nota de Segurança