CVE-2020-19202

Name of the Vulnerable Software and Affected Versions: IPFire version 2.21 (x86 64) - Core Update 130

Description: The issue is related to an authenticated Stored XSS (Cross-site Scripting) in the Captive Portal page. This occurs via the TITLE parameter or the "Title of Login Page" text box in the "captive.cgi" Captive Portal. It allows an authenticated WebGUI user with privileges to execute Stored Cross-site Scripting.

Recommendations: For IPFire version 2.21 (x86 64) - Core Update 130, consider restricting access to the Captive Portal page until a fix is available. As a temporary workaround, avoid using the TITLE parameter in the "captive.cgi" Captive Portal to minimize the risk of exploitation.