CVE-2019-25399

MEDIUM

6.4

Descripcion

IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.

Detalles CVE

Puntuacion CVSS v3.16.4

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado2/18/2026

Ultima modificacion2/26/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

ipfire:ipfire

Debilidades (CWE)

CWE-79

Referencias

https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/46344(disclosure@vulncheck.com)

https://www.ipfire.org(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/ipfire-core-update-stored-xss-via-extrahdcgi(disclosure@vulncheck.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.