« Volver al listado

CVE-2026-27508

Estado: AnalizadaMedia (5.1)—

Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Smoothwall — Smoothwall Express

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-27508",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27508",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-31T17:51:51.058978Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Smoothwall",
          "product": "Express",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.1 Update 13",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-30T17:16:15.440",
  "references": [
    {
      "url": "https://community.smoothwall.org/forum/viewtopic.php?t=45095",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/smoothwall-express-reflected-xss-in-redirect-cgi-via-url-parameter",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link."
    },
    {
      "lang": "es",
      "value": "Las versiones de Smoothwall Express anteriores a 3.1 Update 13 contienen una vulnerabilidad de cross-site scripting reflejado en el endpoint /redirect.cgi debido a una sanitización inadecuada del parámetro url. Los atacantes pueden crear URLs maliciosas con esquemas javascript: que ejecutan JavaScript arbitrario en los navegadores de las víctimas cuando se hace clic en el enlace no sanitizado."
    }
  ],
  "lastModified": "2026-06-17T10:27:16.480",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0BC090B-12A9-4A0E-9BD2-EFA56B569432",
              "versionEndIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update1:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "714B3296-7323-4920-8832-827C697ABED8"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update10:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07EF8E3A-93A2-4A5A-A077-B692D7B4D92F"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update11:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B3D4296-EE7C-46FD-A734-419DC0BDFB7A"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update12:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "230A2DC9-DE28-4D18-99B8-0567CE99969C"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update2:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F0EED85-4850-4303-9529-E45868061C90"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update3:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A0D511A-9CBB-4586-BF80-AAC12101B9E4"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update4:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2999F419-BAF9-4660-8983-BB5A8374450E"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update5:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83811BB5-B833-4594-823D-C47CB8499DD0"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update6:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2A35B5F-2BFD-43D2-B0AC-EFCA7A5A8E2C"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update7:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60C265FF-2CB3-4A44-9017-451D06E2CBE4"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update8:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5DB05A8-F012-4258-82B9-B42884F88722"
            },
            {
              "criteria": "cpe:2.3:o:smoothwall:smoothwall_express:3.1:update9:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5EF08B4-276D-4EE1-A079-3A2E61FED713"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}