XSS in Smoothwall

CVE-2014-9429

Multiple cross-site scripting (XSS) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the (1) PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or (2) COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.014 (70.2th percentile) — read the EPSS interpretation.

Affected products

  • Smoothwall — versions 3.0, 3.1
  • N/a — versions n/a

Weakness classification (CWE)

References