CVE-2019-16914

Опубликовано: 26 сент. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization.

Ссылки

https://github.com/pfsense/pfsense/commit/d31362b69d5d52dc196dc72f66e830cd1e6e9a4f
Patch
Third Party Advisory
https://redmine.pfsense.org/issues/9609
Permissions Required
Third Party Advisory
https://www.seebug.org/vuldb/ssvid-98023
Third Party Advisory
https://github.com/pfsense/pfsense/commit/d31362b69d5d52dc196dc72f66e830cd1e6e9a4f
Patch
Third Party Advisory
https://redmine.pfsense.org/issues/9609
Permissions Required
Third Party Advisory
https://www.seebug.org/vuldb/ssvid-98023
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*

Версия до 2.4.4 (исключая)

cpe:2.3:a:netgate:pfsense:2.4.4:-:*:*:*:*:*:*

cpe:2.3:a:netgate:pfsense:2.4.4:p1:*:*:*:*:*:*

cpe:2.3:a:netgate:pfsense:2.4.4:p2:*:*:*:*:*:*

cpe:2.3:a:netgate:pfsense:2.4.4:p3:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.01833

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-97j6-v4p3-8f67