vendor:
IPFire
by:
Ozer Goker
8.8
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: IPFire
Affected Version From: IPFire 2.21 - Core Update 127
Affected Version To: IPFire 2.21 - Core Update 127
Patch Exists: YES
Related CWE: N/A
CPE: o:ipfire:ipfire:2.21_core127
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Linux
2019
IPFire 2.21 – Core Update 127 | Cross-Site Scripting
IPFire is a Linux distribution that focusses on easy setup, good handling and high level of security. It is operated via an intuitive web-based interface which offers many configuration options for beginning and experienced system administrators. IPFire is maintained by developers who are concerned about security and who update the product regularly to keep it secure. IPFire ships with a custom package manager called Pakfire and the system can be expanded with various add-ons. This vulnerability is a Cross-Site Scripting (XSS) vulnerability which allows an attacker to inject malicious JavaScript code into the web application. The vulnerability exists in five different parameters, four of which are reflected XSS and one is stored XSS.
Mitigation:
The best way to mitigate XSS attacks is to use a combination of input validation, output encoding, and context-sensitive output filtering. Input validation should be used to ensure that all user-supplied data conforms to the expected format and type. Output encoding should be used to ensure that all user-supplied data is properly encoded before being sent to the browser. Context-sensitive output filtering should be used to ensure that all user-supplied data is properly filtered before being sent to the browser.
