Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.
References
Link | Resource |
---|---|
https://docs.netgate.com/downloads/pfSense-SA-21_02.captiveportal.asc | Third Party Advisory |
https://jvn.jp/en/jp/JVN87751554/index.html | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
08 Apr 2022, 02:26
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://docs.netgate.com/downloads/pfSense-SA-21_02.captiveportal.asc - Third Party Advisory | |
References | (MISC) https://jvn.jp/en/jp/JVN87751554/index.html - Third Party Advisory, VDB Entry | |
CPE | cpe:2.3:a:netgate:pfsense_plus:*:*:*:*:*:*:*:* cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
CWE | CWE-79 | |
First Time |
Netgate
Netgate pfsense Plus Pfsense pfsense Pfsense |
31 Mar 2022, 08:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-03-31 08:15
Updated : 2023-12-10 14:22
NVD link : CVE-2021-20729
Mitre link : CVE-2021-20729
CVE.ORG link : CVE-2021-20729
JSON object : View
Products Affected
netgate
- pfsense_plus
pfsense
- pfsense
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')