Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.

Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.

The web user interface of IPFire provided by IPFire Project contains multiple stored cross-site scripting vulnerabilities (CWE-79). This analysis assumes a scenario where one administrative user prepares malicious content, and then another administrative user accesses this content, resulting in a cross-site scripting attack. Satoshi Horikoshi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.