Cross site scripting

2021-07-1216:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

39.9%

JSON

A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.

CPENameOperatorVersion
pfsenseeq2.4.4 p1
pfsensele2.4.4
pfsenseeq2.4.4 p2

Name	Operator	Version
pfsense	eq	2.4.4 p1
pfsense	le	2.4.4
pfsense	eq	2.4.4 p2

References

docs.netgate.com/pfsense/en/latest/releases/2-4-4-p3.html

gist.github.com/dharmeshbaskaran/fd3779006361d07651a883e8a040d916

www.pfsense.org/download/

0.001 Low

EPSS

Percentile

39.9%

JSON

Related for PRION:CVE-2020-19201