CVE-2025-34313
Full vulnerability record from the local CVENow database.
Description
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to USERQUOTA and the assigned user(s) provided in the QUOTA_USERS parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected quota entry.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-28 15:16:11.613000
Last modified
2026-10-19 13:10:00.110000
View original CVE JSON
{
"id": "CVE-2025-34313",
"sourceIdentifier": "[email protected]",
"published": "2025-10-28T15:16:11.613",
"lastModified": "2026-10-19T13:10:00.110",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to USERQUOTA and the assigned user(s) provided in the QUOTA_USERS parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected quota entry."
},
{
"lang": "es",
"value": "Las versiones de IPFire anteriores a la 2.29 (Core Update 198) contienen una vulnerabilidad de cross-site scripting (XSS) almacenado que permite a un atacante autenticado inyectar código JavaScript arbitrario a través del parámetro QUOTA_USERS al crear una regla de cuota de usuario. Cuando un usuario añade una nueva regla de cuota de usuario, la aplicación emite una solicitud HTTP POST a /cgi-bin/urlfilter.cgi con el parámetro MODE establecido en USERQUOTA y el/los usuario(s) asignado(s) proporcionado(s) en el parámetro QUOTA_USERS. El valor de este parámetro se almacena y posteriormente se renderiza en la interfaz web sin una sanitización o codificación adecuadas, permitiendo que los scripts inyectados se ejecuten en el contexto de otros usuarios que ven la entrada de cuota afectada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "IPFire.org",
"product": "IPFire",
"defaultStatus": "unaffected",
"modules": [
"/cgi-bin/urlfilter.cgi"
],
"versions": [
{
"version": "0",
"lessThan": "2.29 (Core Update 198)",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-28T20:02:13.998238Z",
"id": "CVE-2025-34313",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29",
"matchCriteriaId": "9A0A85D3-A192-4FD9-9510-99D85BCF334A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*",
"matchCriteriaId": "A39350F9-D6D9-49A5-88BC-C5489AA6038C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*",
"matchCriteriaId": "CDDC0CEB-073B-41A0-8A52-4DAAAD77AA6D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*",
"matchCriteriaId": "745640B9-2180-48C3-82CC-D6E73AAF95D5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*",
"matchCriteriaId": "08006D41-7288-4333-83FE-B6FD7CD5C779"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*",
"matchCriteriaId": "15EE4FEE-62AB-4172-B898-19DE6F50B7AC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*",
"matchCriteriaId": "5B0ECE9B-DD45-40E1-842A-0B0B1786187E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*",
"matchCriteriaId": "9B9BDB00-A750-4053-8812-5A3854042CB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*",
"matchCriteriaId": "16F654D7-CC82-4428-BBEF-1110CAE75597"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*",
"matchCriteriaId": "FFCC61A9-AF1B-4F8A-98D2-FB7854AF0EF6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*",
"matchCriteriaId": "7A66DC97-E88F-455E-B688-88BCC95E861B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*",
"matchCriteriaId": "DDF56682-47E8-436F-B5FE-55A8B525D699"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*",
"matchCriteriaId": "A4ADE9ED-675A-4577-AF4A-047B4D7D8E2D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*",
"matchCriteriaId": "3FA0F87A-3926-4B10-97C8-12EBFD9454D8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*",
"matchCriteriaId": "0E2F1488-B8FA-4BFF-81B9-308E0C462B47"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*",
"matchCriteriaId": "3480B74D-D516-4A8C-AAA3-C7990FEA345D"
}
]
}
]
}
],
"references": [
{
"url": "https://bugzilla.ipfire.org/show_bug.cgi?id=13888",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Third Party Advisory"
]
},
{
"url": "https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://www.vulncheck.com/advisories/ipfire-stored-xss-via-user-quota-rule-url-filter",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}