CVE-2020-19201 — Cross-site Scripting in Pfsense

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.8%
top 25.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netgate Pfsense
Timeline
PublishedJul 12
Latest updateMay 24

Description

A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages1 packages

▶NVDnetgate/pfsense2.4.4+1

🔴Vulnerability Details

2
GHSA
GHSA-5rh9-j8fm-2vv4: Netgate pfSense 2↗2022-05-24
▶
CVEList
CVE-2020-19201: A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload↗2021-07-12
▶
CVE-2020-19201 — Cross-site Scripting in Pfsense | cvebase