CVE-2022-36368

Опубликовано: 24 окт. 2022

Источник: nvd

CVSS3: 4.8

EPSS Низкий

Описание

Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.

Ссылки

https://blog.ipfire.org/post/ipfire-2-27-core-update-170-released
Release Notes
Vendor Advisory
https://bugzilla.ipfire.org/show_bug.cgi?id=12925
Issue Tracking
Vendor Advisory
https://github.com/ipfire/ipfire-2.x
Product
Third Party Advisory
https://jvn.jp/en/jp/JVN15411362/index.html
Third Party Advisory
https://blog.ipfire.org/post/ipfire-2-27-core-update-170-released
Release Notes
Vendor Advisory
https://bugzilla.ipfire.org/show_bug.cgi?id=12925
Issue Tracking
Vendor Advisory
https://github.com/ipfire/ipfire-2.x
Product
Third Party Advisory
https://jvn.jp/en/jp/JVN15411362/index.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*

Версия до 2.27 (исключая)

cpe:2.3:a:ipfire:ipfire:2.27:core_update159:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update160:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update161:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update162:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update163:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update164:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update165:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update166:*:*:*:*:*:*

cpe:2.3:a:ipfire:ipfire:2.27:core_update167:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00235

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-488g-whpv-px3q