Cross site scripting

2022-01-2619:15:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.1%

/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST[‘pkg_filter’] in a PHP echo call, causing XSS.

CPENameOperatorVersion
pfsenselt2.6.0
pfsense_pluslt22.01

CPE	Name	Operator	Version
	pfsense	lt	2.6.0
	pfsense_plus	lt	22.01

References

docs.netgate.com/downloads/pfSense-SA-22_04.webgui.asc

github.com/pfsense/pfsense/commit/5d82cce0d615a76b738798577a28a15803e59aeb