Cross-Site Request Forgery in OPNsense Community and Business Editions
CVE-2023-38999

6.5MEDIUM

Key Information:

Vendor

Opnsense

Status
Opnsense
Vendor
CVE Published:
9 August 2023

What is CVE-2023-38999?

A vulnerability exists in the System Halt API of OPNsense, affecting both Community and Business Editions up to their respective versions. Attackers can exploit this flaw by sending a specially crafted GET request, leading to a Denial of Service (DoS) condition. Users of OPNsense should ensure they update their systems to the latest versions to mitigate this risk.

References

https://github.com/opnsense/core/commit/5d68f43d1f2541448...
https://logicaltrust.net/blog/2023/08/opnsense.html

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.