FKIE_CVE-2025-34308

Vulnerability from fkie_nvd - Published: 2025-10-28 15:16 - Updated: 2025-11-03 17:01
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATE_VALUE parameter when updating the default time synchronization settings. When the default values displayed on the Time Server page are updated, the application issues an HTTP POST request to /cgi-bin/time.cgi, and the synchronization value is provided in the UPDATE_VALUE parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected Time Server configuration page.
References
disclosure@vulncheck.comhttps://bugzilla.ipfire.org/show_bug.cgi?id=13883Issue Tracking, Third Party Advisory
disclosure@vulncheck.comhttps://www.ipfire.org/blog/ipfire-2-29-core-update-198-releasedRelease Notes
disclosure@vulncheck.comhttps://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-time-syncThird Party Advisory
Impacted products
Vendor Product Version
ipfire ipfire *
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A0A85D3-A192-4FD9-9510-99D85BCF334A",
              "versionEndExcluding": "2.29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*",
              "matchCriteriaId": "A39350F9-D6D9-49A5-88BC-C5489AA6038C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*",
              "matchCriteriaId": "CDDC0CEB-073B-41A0-8A52-4DAAAD77AA6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*",
              "matchCriteriaId": "745640B9-2180-48C3-82CC-D6E73AAF95D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*",
              "matchCriteriaId": "08006D41-7288-4333-83FE-B6FD7CD5C779",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*",
              "matchCriteriaId": "15EE4FEE-62AB-4172-B898-19DE6F50B7AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*",
              "matchCriteriaId": "5B0ECE9B-DD45-40E1-842A-0B0B1786187E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*",
              "matchCriteriaId": "9B9BDB00-A750-4053-8812-5A3854042CB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*",
              "matchCriteriaId": "16F654D7-CC82-4428-BBEF-1110CAE75597",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*",
              "matchCriteriaId": "FFCC61A9-AF1B-4F8A-98D2-FB7854AF0EF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*",
              "matchCriteriaId": "7A66DC97-E88F-455E-B688-88BCC95E861B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*",
              "matchCriteriaId": "DDF56682-47E8-436F-B5FE-55A8B525D699",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*",
              "matchCriteriaId": "A4ADE9ED-675A-4577-AF4A-047B4D7D8E2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*",
              "matchCriteriaId": "3FA0F87A-3926-4B10-97C8-12EBFD9454D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*",
              "matchCriteriaId": "0E2F1488-B8FA-4BFF-81B9-308E0C462B47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*",
              "matchCriteriaId": "3480B74D-D516-4A8C-AAA3-C7990FEA345D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IPFire versions prior to 2.29 (Core Update 198) contain\u00a0a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATE_VALUE parameter when updating the default time synchronization settings. When the default values displayed on the Time Server page are updated, the application issues an HTTP POST request to /cgi-bin/time.cgi, and the synchronization value is provided in the UPDATE_VALUE parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected Time Server configuration page."
    }
  ],
  "id": "CVE-2025-34308",
  "lastModified": "2025-11-03T17:01:51.640",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-10-28T15:16:11.080",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.ipfire.org/show_bug.cgi?id=13883"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-time-sync"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.