CVE-2022-29273 — Cross-site Scripting in Pfsense

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
38.0%
top 2.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netgate Pfsense
Timeline
PublishedFeb 22

Description

pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDnetgate/pfsense< 22.05+1

Patches

Patch: redmine.pfsense.org ↗Patch: redmine.pfsense.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-5v93-vgwv-qch2: pfSense CE through 2↗2023-02-22
▶
CVEList
CVE-2022-29273: pfSense CE through 2↗2023-02-22
▶
CVE-2022-29273 — Cross-site Scripting in Pfsense | cvebase