Medium severity4.8NVD Advisory· Published Oct 24, 2022· Updated Jun 17, 2026
CVE-2022-36368
CVE-2022-36368
Description
Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*range: <2.27
- cpe:2.3:a:ipfire:ipfire:2.27:core_update159:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update160:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update161:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update162:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update163:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update164:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update165:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update166:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.27:core_update167:*:*:*:*:*:*
- (no CPE)range: <2.27
- IPFire Project/IPFirev5Range: versions prior to 2.27
Patches
Vulnerability mechanics
References
3- blog.ipfire.org/post/ipfire-2-27-core-update-170-releasednvdRelease NotesVendor Advisory
- bugzilla.ipfire.org/show_bug.cginvdIssue TrackingVendor Advisory
- jvn.jp/en/jp/JVN15411362/index.htmlnvdThird Party Advisory
News mentions
0No linked articles in our index yet.