PT-2021-10307
CVE-2020-19202
·
تاريخ النشر
2021-06-17
·
تاريخ التحديث
2021-06-22
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
IPFire version 2.21 (x86 64) - Core Update 130
Description:
The issue is related to an authenticated Stored XSS (Cross-site Scripting) in the Captive Portal page. This occurs via the
TITLE parameter or the "Title of Login Page" text box in the "captive.cgi" Captive Portal. It allows an authenticated WebGUI user with privileges to execute Stored Cross-site Scripting.Recommendations:
For IPFire version 2.21 (x86 64) - Core Update 130, consider restricting access to the Captive Portal page until a fix is available. As a temporary workaround, avoid using the
TITLE parameter in the "captive.cgi" Captive Portal to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾