Headline
CVE-2022-31792: Firebox WebUI Stored Cross-Site Scripting (XSS) Vulnerability | WatchGuard Technologies
A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
Advisory ID
WGSA-2022-00014
Published Date
2022-06-23
Workaround Available
False
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Summary
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox and XTM appliances. An unauthenticated remote attacker can potentially execute arbitrary JavaScript code in the Firebox management interface by sending carefully crafted requests to exposed management ports.
Affected
Fireware OS before 12.8.1, 12.x before 12.1.4, and 12.2.x through 12.5.x before 12.5.10.
Resolution
Fireware OS 12.8.1, 12.5.10 and 12.1.4
Credits
Internally discovered
Advisory Product List
Product Family
Product Branch
Product List