CVE-2019-25399

Name of the Vulnerable Software and Affected Versions IPFire version 2.21 Core Update 127

Description The software contains multiple stored cross-site scripting issues in the extrahd.cgi script. Attackers can inject malicious scripts through the FS, PATH, and UUID parameters. By submitting POST requests with script payloads in these parameters, attackers can execute arbitrary JavaScript within authenticated administrator sessions. The vulnerable parameters are FS, PATH, and UUID. The affected API endpoint is extrahd.cgi.

Recommendations Apply updates to address the issue in IPFire version 2.21 Core Update 127.