PT-2023-6859 · Opnsense · Opnsense
Yasar Klawohn
·
Publicado
2023-09-19
·
Atualizado
2023-11-13
·
CVE-2023-44275
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
OPNsense versions prior to 23.7.5
Description
The issue is related to the lack of protection of the web page structure in the OPNsense operating system. This can be exploited by a remote attacker to conduct cross-site scripting attacks using the
column count parameter in the "index.php" page, specifically targeting the Lobby Dashboard.Recommendations
For versions prior to 23.7.5, update to version 23.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Lobby Dashboard or disabling the
column count parameter in the index.php page until a patch is applied.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Opnsense