Stored XSS Vulnerability in pfSense by Netgate
CVE-2019-12347

6.1MEDIUM

Key Information:

Vendor

Netgate

Status
Pfsense
Vendor
CVE Published:
29 May 2019

What is CVE-2019-12347?

In pfSense version 2.4.4-p3, a vulnerability allows attackers to perform stored XSS attacks by injecting malicious scripts into the Name or Description fields through the acme_accountkeys_edit.php action. This arises due to inadequate input validation, which can lead to unauthorized access or manipulation of user sessions.

References

https://redmine.pfsense.org/issues/9554#change-40729
x_refsource_MISC
https://www.pfsense.org/download/
x_refsource_MISC
https://ctrsec.io/index.php/2019/05/28/stored-xss-acme-pf...
x_refsource_MISC

EPSS Score

75% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.