Description
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.
CVSS breakdown
CVSS 3.1
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected products
- Stormshield / Stormshield Network Security5.0.0 – 5.0.9
- Stormshield / Stormshield Network Security5.1.0 – 5.1.3
- Stormshield / Stormshield Network Security5.0.10 – 5.0.10
- Stormshield / Stormshield Network Security5.1.4 EA – 5.1.4 EA
References
- VENDOR_ADVISORYhttps://advisories.stormshield.eu/2026-022/
Updated 10m ago · 8 sources