| Package | Affected versions | Patched versions |
|---|---|---|
| firewall community | ≤ 3.3.25 |
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free