CVE-2020-19201: XSS
A Stored Cross-Site Scripting (XSS) vulnerability was found in statusfilterreload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-19201?
CVE-2020-19201 is a Stored Cross-Site Scripting (XSS) vulnerability found in the pfSense software WebGUI.
How does CVE-2020-19201 impact my system?
CVE-2020-19201 allows an attacker to execute malicious scripts in the context of a user's browser, leading to potential data theft or unauthorized actions.
Which versions of Netgate pfSense are affected by CVE-2020-19201?
Netgate pfSense versions 2.4.4-p2 and earlier are affected by CVE-2020-19201.
What is the severity rating of CVE-2020-19201?
CVE-2020-19201 has a severity rating of medium with a CVSS score of 5.4.
How can I mitigate CVE-2020-19201?
To mitigate CVE-2020-19201, upgrade your Netgate pfSense software to version 2.4.4-p3 or later.