CVE-2020-21219: XSS

Published Dec 15, 2022

Updated

Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acmecertificateedit.php page of the ACME package.

Affected Software

2 affected components

Netgate ACME=0.6.3

Netgate pfSense=2.4.4-p3

Remediation

Patch Available

https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8

Event History

Dec 15, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2020-21219?

The severity of CVE-2020-21219 is medium.

What is the vulnerability description of CVE-2020-21219?

CVE-2020-21219 is a Cross Site Scripting (XSS) vulnerability in Netgate pfSense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 that allows remote attackers to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.

How does CVE-2020-21219 affect Netgate ACME package?

CVE-2020-21219 affects Netgate ACME package 0.6.3.

How does CVE-2020-21219 affect Netgate pfSense?

CVE-2020-21219 affects Netgate pfSense 2.4.4-Release-p3.

What is the Common Weakness Enumeration (CWE) for CVE-2020-21219?

The CWE for CVE-2020-21219 is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')