Dismissed
Permalink
CVE-2019-25374
6.1 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): CHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
by @jopejoe1 Activity log
- Created automatic suggestion
-
@jopejoe1
removed
6 packages
- prometheus-opnsense-exporter
- python312Packages.pyopnsense
- python314Packages.pyopnsense
- home-assistant-component-tests.opnsense
- python313Packages.pyopnsense
- tests.home-assistant-component-tests.opnsense
- @jopejoe1 dismissed
OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. Attackers can craft POST requests with JavaScript payloads in the passthrough_networks parameter to execute arbitrary code in users' browsers.
References
- ExploitDB-46351 exploit
- OPNsense Official Website product
- OPNsense 19.1.1 Release Announcement patch
- VulnCheck Advisory: OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php third-party-advisory
- ExploitDB-46351 exploit
- OPNsense Official Website product
- OPNsense 19.1.1 Release Announcement patch
- VulnCheck Advisory: OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php third-party-advisory
Affected products
OPNsense
- ==19.1