Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.
References
| Link | Resource |
|---|---|
| https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8 | Patch Third Party Advisory |
| https://redmine.pfsense.org/issues/9888 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
19 Dec 2022, 16:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://redmine.pfsense.org/issues/9888 - Third Party Advisory | |
| References | (MISC) https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8 - Patch, Third Party Advisory | |
| First Time |
Netgate
Netgate acme Netgate pfsense |
|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:netgate:acme:0.6.3:*:*:*:*:*:*:* cpe:2.3:a:netgate:pfsense:2.4.4:p3:*:*:*:*:*:* |
15 Dec 2022, 19:56
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-15 19:15
Updated : 2023-12-10 14:48
NVD link : CVE-2020-21219
Mitre link : CVE-2020-21219
CVE.ORG link : CVE-2020-21219
JSON object : View
Products Affected
netgate
- acme
- pfsense
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')