CVE-2019-12584: XSS

Q: What is CVE-2019-12584?

CVE-2019-12584 is a Cross-Site Scripting (XSS) vulnerability in Apcupsd 0.3.91_5, which is used in pfSense through 2.4.4-RELEASE-p3 and other products.

Q: What is the severity of CVE-2019-12584?

The severity of CVE-2019-12584 is medium (CVSS score: 6.1).

Q: How does CVE-2019-12584 affect Apcupsd and pfSense?

CVE-2019-12584 affects Apcupsd 0.3.91_5 in pfSense through 2.4.4-RELEASE-p3 and other products, allowing for Cross-Site Scripting (XSS) attacks through apcupsd_status.php.

Q: What is the fix for CVE-2019-12584?

To fix CVE-2019-12584, it is recommended to update Apcupsd to a version that addresses the XSS issue, such as Apcupsd 0.3.91_6 or later.

Q: Is there any additional information about CVE-2019-12584?

Yes, you can find additional information about CVE-2019-12584 on the CTRSec website, GitHub repository, and the pfSense Redmine issue.

Published Jun 3, 2019

Updated

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsdstatus.php.

Affected Software

6 affected components

Apcupsd Apcupsd=0.3.91_5

Netgate pfSense<2.4.4

Netgate pfSense=2.4.4

Netgate pfSense=2.4.4-p1

Netgate pfSense=2.4.4-p2

Netgate pfSense=2.4.4-p3

Remediation

Patch Available

https://github.com/pfsense/FreeBSD-ports/commit/b492c0ea47aba8dde2f14183e71498ba207594e3

Event History

Jun 3, 2019

CVE Published

via MITRE·02:27 AM

Data Sourced

via MITRE·02:27 AM

Description

Frequently Asked Questions

What is CVE-2019-12584?

CVE-2019-12584 is a Cross-Site Scripting (XSS) vulnerability in Apcupsd 0.3.91_5, which is used in pfSense through 2.4.4-RELEASE-p3 and other products.

What is the severity of CVE-2019-12584?

The severity of CVE-2019-12584 is medium (CVSS score: 6.1).

How does CVE-2019-12584 affect Apcupsd and pfSense?