CVE-2022-36368

Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
jpcertCNA
---
---
CVEADP
---
---
CISA-ADPADP
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
VendorProductVersion
ipfireipfire
𝑥
< 2.27
ipfireipfire
2.27:core_update159
ipfireipfire
2.27:core_update160
ipfireipfire
2.27:core_update161
ipfireipfire
2.27:core_update162
ipfireipfire
2.27:core_update163
ipfireipfire
2.27:core_update164
ipfireipfire
2.27:core_update165
ipfireipfire
2.27:core_update166
ipfireipfire
2.27:core_update167
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://blog.ipfire.org/post/ipfire-2-27-core-update-170-released
https://bugzilla.ipfire.org/show_bug.cgi?id=12925
https://github.com/ipfire/ipfire-2.x
https://jvn.jp/en/jp/JVN15411362/index.html
https://blog.ipfire.org/post/ipfire-2-27-core-update-170-released
https://bugzilla.ipfire.org/show_bug.cgi?id=12925
https://github.com/ipfire/ipfire-2.x
https://jvn.jp/en/jp/JVN15411362/index.html