CVE-2020-19204

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-12 · updated 2026-06-17
Weakness: CWE-79

Description

An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in the "routing.cgi" Routing Table Entries via the "Remark" text box or "remark" parameter. It allows an authenticated WebGUI user to execute Stored Cross-site Scripting in the Routing Table Entries.

Affected products

IPFire.org IPFire: 2.21-core_update130

References

https://blog.ipfire.org/post/ipfire-2-23-core-update-133-has-been-released
https://gist.github.com/dharmeshbaskaran/1fdc069c0ad729d12bf3304b5f19b02d
https://www.lightningwirelabs.com
https://blog.ipfire.org/post/ipfire-2-23-core-update-133-has-been-released
https://gist.github.com/dharmeshbaskaran/1fdc069c0ad729d12bf3304b5f19b02d
https://www.lightningwirelabs.com

Get alerted when CVE-2020-19204 or the next vulnerability affects your stack