CVE-2025-34305

{"id": "CVE-2025-34305", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34305", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-29T18:09:03.089530Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "IPFire.org", "modules": ["/var/ipfire/header.pl"], "product": "IPFire", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29 (Core Update 198)", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-28T15:16:10.760", "references": [{"url": "https://bugzilla.ipfire.org/show_bug.cgi?id=13880", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ipfire-stored-xss-via-multiple-methods-in-cleanhtml", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function (/var/ipfire/header.pl) that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpoints - for example, POST /cgi-bin/wakeonlan.cgi (CLIENT_COMMENT), /cgi-bin/dhcp.cgi (ADVOPT_DATA, FIX_REMARK, FIX_FILENAME, FIX_ROOTPATH), /cgi-bin/connscheduler.cgi (ACTION_COMMENT), /cgi-bin/dnsforward.cgi (REMARK), /cgi-bin/vpnmain.cgi (REMARK), or /cgi-bin/dns.cgi (REMARK) - the application calls escape() and HTML::Entities::encode_entities() but never assigns the sanitized result back to the output variable. The original unsanitized value is therefore stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected entries."}, {"lang": "es", "value": "Las versiones de IPFire anteriores a la 2.29 (Core Update 198) contienen m\u00faltiples vulnerabilidades de cross-site scripting (XSS) almacenado causadas por un error en la funci\u00f3n cleanhtml() (/var/ipfire/header.pl) que no aplica la codificaci\u00f3n de entidades HTML a la entrada del usuario. Cuando un usuario autenticado env\u00eda datos a los puntos finales afectados -por ejemplo, POST /cgi-bin/wakeonlan.cgi (CLIENT_COMMENT), /cgi-bin/dhcp.cgi (ADVOPT_DATA, FIX_REMARK, FIX_FILENAME, FIX_ROOTPATH), /cgi-bin/connscheduler.cgi (ACTION_COMMENT), /cgi-bin/dnsforward.cgi (REMARK), /cgi-bin/vpnmain.cgi (REMARK), o /cgi-bin/dns.cgi (REMARK)- la aplicaci\u00f3n llama a escape() y HTML::Entities::encode_entities() pero nunca asigna el resultado saneado de vuelta a la variable de salida. El valor original sin sanear se almacena, por lo tanto, y se renderiza posteriormente en la interfaz web sin la sanaci\u00f3n o codificaci\u00f3n adecuadas, permitiendo que los scripts inyectados se ejecuten en el contexto de otros usuarios que visualizan las entradas afectadas."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A0A85D3-A192-4FD9-9510-99D85BCF334A", "versionEndExcluding": "2.29"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A39350F9-D6D9-49A5-88BC-C5489AA6038C"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDDC0CEB-073B-41A0-8A52-4DAAAD77AA6D"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "745640B9-2180-48C3-82CC-D6E73AAF95D5"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08006D41-7288-4333-83FE-B6FD7CD5C779"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15EE4FEE-62AB-4172-B898-19DE6F50B7AC"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B0ECE9B-DD45-40E1-842A-0B0B1786187E"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B9BDB00-A750-4053-8812-5A3854042CB4"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F654D7-CC82-4428-BBEF-1110CAE75597"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFCC61A9-AF1B-4F8A-98D2-FB7854AF0EF6"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A66DC97-E88F-455E-B688-88BCC95E861B"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDF56682-47E8-436F-B5FE-55A8B525D699"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4ADE9ED-675A-4577-AF4A-047B4D7D8E2D"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FA0F87A-3926-4B10-97C8-12EBFD9454D8"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E2F1488-B8FA-4BFF-81B9-308E0C462B47"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3480B74D-D516-4A8C-AAA3-C7990FEA345D"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}