CVE-2020-10797: XSS
Published Apr 29, 2020
·Updated
An XSS vulnerability resides in the hostname field of the diagping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed.
Affected Software
1 affected component
Netgate pfSense<2.4.5
Remediation
Event History
Apr 29, 2020
CVE Published
via MITRE·01:29 PM
Data Sourced
via MITRE·01:29 PM
Description
Frequently Asked Questions
1
What is CVE-2020-10797?
CVE-2020-10797 is an XSS vulnerability that resides in the hostname field of the diag_ping.php page in pfSense before version 2.4.5.
2
How does CVE-2020-10797 affect pfSense?
CVE-2020-10797 affects pfSense versions before 2.4.5.
3
What is the severity of CVE-2020-10797?
CVE-2020-10797 has a severity rating of 6.1 (medium).
4
How can CVE-2020-10797 be exploited?
CVE-2020-10797 can be exploited by passing malicious inputs to the hostname field of the diag_ping.php page.
5
Is there a fix for CVE-2020-10797?
Yes, the fix for CVE-2020-10797 is included in pfSense version 2.4.5.