PT-2025-44173 · Ipfire · Ipfire

Alex Williams · Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-34314

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 (Core Update 198)

Description The software contains a stored cross-site scripting (XSS) issue that allows an authenticated attacker to inject arbitrary JavaScript code. This is achieved by manipulating the SRC, DST, and COMMENT parameters when creating a time constraint rule. The application sends an HTTP POST request to the /cgi-bin/urlfilter.cgi endpoint with the MODE parameter set to TIMECONSTRAINT. The values provided in the SRC, DST, and COMMENT parameters are stored and displayed in the web interface without sufficient sanitization, enabling the execution of injected scripts within the context of other users viewing the affected time constraint entry.

Recommendations Update to version 2.29 (Core Update 198) or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34314

Affected Products

Ipfire

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-34314 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34314 · Vendor Advisory
• https://vulncheck.com/advisories/ipfire-stored-xss-via-time-constraint-rule-url-filter · Note
• https://twitter.com/VulmonFeeds/status/1983335879151153643 · Twitter Post
• https://bugzilla.ipfire.org/show_bug.cgi?id=13889 · Note
• https://twitter.com/CVEnew/status/1983185724074529085 · Twitter Post
• https://ipfire.org/blog/ipfire-2-29-core-update-198-released · Patch, Vendor Advisory