CVE-2020-11457: XSS
First published: Wed Apr 01 2020(Updated: )
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netgate pfSense | <2.4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/157104/pfSense-2.4.4-P3-User-Manager-Cross-Site-Scripting.html
- https://github.com/pfsense/pfsense/commit/3c1e53dabe966f27c9097a5a923e77f49ae5fffa
- https://www.exploit-db.com/exploits/48300
- https://www.netgate.com/assets/downloads/advisories/pfSense-SA-20_06.webgui.asc
Frequently Asked Questions
What is the vulnerability ID of the stored XSS vulnerability in pfSense?
The vulnerability ID is CVE-2020-11457.
What is the affected software?
The affected software is pfSense versions up to 2.4.5.
What is the severity of CVE-2020-11457?
The severity of CVE-2020-11457 is medium.
How can the vulnerability be exploited?
The vulnerability can be exploited through the descr parameter (full name) of a user in the WebGUI of pfSense.
Are there any known fixes for CVE-2020-11457?
Yes, the fix for CVE-2020-11457 is included in pfSense version 2.4.5.
- collector/nvd-index
- vendor/netgate
- canonical/netgate pfsense