Stored Cross-Site Scripting Vulnerability in IPFire by Lightning Wire Labs
CVE-2020-19204

5.4MEDIUM

Key Information:

Vendor: Ipfire
Status: Ipfire
Vendor: CVE Published:; 12 July 2021

What is CVE-2020-19204?

An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists in the Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130. This security flaw is present in the 'routing.cgi' component, specifically in the Routing Table Entries feature accessed via the 'Remark' text box or 'remark' parameter. An authenticated WebGUI user may exploit this vulnerability to execute malicious scripts, potentially compromising the security of the web application and its users.