PT-2023-12967 · Unknown · Pfsense Ce+1

CVE-2022-29273 · Publicado 2023-02-22 · Atualizado 2023-04-10

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions pfSense CE versions 2.6.0 and earlier pfSense Plus versions prior to 22.05

Description The issue allows for XSS in the WebGUI via URL Table Alias URL parameters. This means an attacker could potentially inject malicious scripts into the web interface of the affected software, exploiting the URL parameter in the URL Table Alias functionality.

Recommendations For pfSense CE versions 2.6.0 and earlier, update to a version later than 2.6.0. For pfSense Plus versions prior to 22.05, update to version 22.05 or later. As a temporary workaround, consider restricting access to the WebGUI to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-29273

Produtos afetados

Pfsense Ce

Pfsense Plus

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-29273 · Nota de Segurança
• https://redmine.pfsense.org/issues/13060 · Correção
• https://t.me/cvenotify/44809 · Publicação no Telegram
• https://t.me/cibsecurity/58717 · Publicação no Telegram
• https://docs.netgate.com/downloads/pfSense-SA-22_05.webgui.asc · Nota
• https://osv.dev/vulnerability/CVE-2022-29273 · Aviso do Fabricante
• https://docs.netgate.com/pfsense/en/latest/releases/index.html#current-and-upcoming-supported-releases · Nota