Stored XSS in pfSense WebGUI User Manager
CVE-2020-11457

5.4MEDIUM

Key Information:

Vendor: Netgate
Status: Pfsense
Vendor: CVE Published:; 1 April 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-11457?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the pfSense WebGUI, specifically within the user management feature. This vulnerability occurs in the system_usermanager_addprivs.php file, where the 'descr' parameter (typically used for a user’s full name) can be exploited by an attacker. By injecting malicious scripts into this parameter, an unauthorized user could execute scripts within the context of an authenticated user's session, posing significant risks to the confidentiality and integrity of user data. It is crucial for pfSense users to update to version 2.4.5 or later to mitigate potential exploitation of this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-11457 - Proof of Concept