Project

General

Profile

Actions
Copy link

Bug #16924

closed
JP JP

Potential stored XSS via Firewall Schedules

Bug #16924: Potential stored XSS via Firewall Schedules

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Rules / NAT
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Firewall rule schedule descriptions are printed without sufficient encoding on firewall_rules.php when the schedule is in use.

The page escapes single quotes in the description, but an XSS payload using double quotes is not escaped.

Files

16924.patch (1.38 KB) 16924.patch Jim Pingle, 07/01/2026 07:30 PM
Actions
Copy link

Also available in: Atom