CVE-2021-20729

Опубликовано: 31 мар. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.

Ссылки

https://docs.netgate.com/downloads/pfSense-SA-21_02.captiveportal.asc
Third Party Advisory
https://jvn.jp/en/jp/JVN87751554/index.html
Third Party Advisory
VDB Entry
https://docs.netgate.com/downloads/pfSense-SA-21_02.captiveportal.asc
Third Party Advisory
https://jvn.jp/en/jp/JVN87751554/index.html
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:netgate:pfsense_plus:*:*:*:*:*:*:*:*

Версия до 21.05 (включая)

cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*

Версия до 2.5.2 (включая)

EPSS

Процентиль: 53%

0.00306

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-gmq9-rc2w-2c75