CVE-2019-25399: ipfire

csirt@kutim:~/threat-intel/cve/CVE-2019-25399

CVSS 6.4 · Medium EPSS 0,25%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ipfire. Skor CVSS 3.1 6.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.

Rincian

Terbit di NVD: 18 Februari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,25% peluang dieksploitasi; lebih tinggi dari 14,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ipfire	ipfire	Versi 2.21 core_update127

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.exploit-db.com/exploits/46344 exploit · advisory pihak ketiga · vdb entry
https://www.vulncheck.com/advisories/ipfire-core-update-stored-xss-via-extrahdcgi broken link · advisory pihak ketiga
https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso product
https://www.ipfire.org product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.