cbcvebase.
CVE-2019-12347
published 2019-05-29

CVE-2019-12347: In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php…

PriorityP355medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
58.58%
99.0th percentile
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.

Affected

1 ranges
VendorProductVersion rangeFixed in
netgatepfsense——

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://192.168.1.1/acme/acme_accountkeys_edit.php↗
path/acme/acme_accountkeys_edit.php↗
  • →Alert on stored/persistent XSS attempts targeting pfSense 2.4.4-p3 with ACME Package 0.5.7_1 or 0.59_14 via the ACME account keys edit page ↗
  • ·The vulnerable endpoint is only reachable on the pfSense web management interface; exploitation requires authenticated access to the ACME package configuration page ↗
  • ·The XSS is stored/persistent, meaning the payload is saved and executed for any user who subsequently views the Name or Description field — not just the attacker's session ↗

CVSS provenance

nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.