Stored XSS in pfSense WebGUI User Manager

CVE-2020-11457

What is CVE-2020-11457?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the pfSense WebGUI, specifically within the user management feature. This vulnerability occurs in the system_usermanager_addprivs.php file, where the 'descr' parameter (typically used for a user’s full name) can be exploited by an attacker. By injecting malicious scripts into this parameter, an unauthorized user could execute scripts within the context of an authenticated user's session, posing significant risks to the confidentiality and integrity of user data. It is crucial for pfSense users to update to version 2.4.5 or later to mitigate potential exploitation of this vulnerability.

References