CVE-2023-44276

2023-09-2805:15:46

Google

osv.dev

opnsense

xss

vulnerability

index.php

lobby dashboard

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.6%

JSON

OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.

CPENameOperatorVersion
coreeq23.1.b
coreeq15.1.12
coreeq23.7.r
coreeq21.1.b
coreeq18.7.r
coreeq23.7.b
coreeq18.1.b
coreeq21.7.r
coreeq22.1.b
coreeq15.1.10.2

Name	Operator	Version
core	eq	23.1.b
core	eq	15.1.12
core	eq	23.7.r
core	eq	21.1.b
core	eq	18.7.r
core	eq	23.7.b
core	eq	18.1.b
core	eq	21.7.r
core	eq	22.1.b
core	eq	15.1.10.2

Rows per page:

1-10 of 751

References

github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7

github.com/opnsense/core/compare/23.7.4...23.7.5

www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense