Stored Cross-Site Scripting Vulnerabilities in IPFire Web UI

CVE-2022-36368

What is CVE-2022-36368?

IPFire, a popular open-source firewall solution, has multiple stored cross-site scripting vulnerabilities in its web user interface prior to version 2.27. These vulnerabilities enable a remote authenticated attacker, who holds administrative privileges, to inject and execute arbitrary scripts, potentially compromising the security of the system. This issue underscores the importance of keeping your firewall software updated to mitigate such risks.

References