CVE-2020-10797 — Cross-site Scripting in Pfsense

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
4.5%
top 10.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netgate Pfsense
Timeline
PublishedApr 29
Latest updateMay 24

Description

An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDnetgate/pfsense< 2.4.5

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rhvw-j7hf-3g3r: An XSS vulnerability resides in the hostname field of the diag_ping↗2022-05-24
▶
CVEList
CVE-2020-10797: An XSS vulnerability resides in the hostname field of the diag_ping↗2020-04-29
▶
CVE-2020-10797 — Cross-site Scripting in Pfsense | cvebase