PT-2023-6862 · Netgate · Pfsense

Oskar Zeino-Mahmalat

·

Publicado

2023-10-31

·

Atualizado

2023-12-19

·

CVE-2023-42327

CVSS v3.1

5.4

Média

VetorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Netgate pfSense version 2.7.0
Description The issue is related to a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to gain privileges via a crafted URL to the "getserviceproviders.php" page. This vulnerability is associated with a lack of protection for the web page structure. Exploitation of this issue can enable a remote attacker to elevate their privileges.
Recommendations For version 2.7.0, consider disabling access to the "getserviceproviders.php" page until a patch is available. Restricting access to this page can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-07876
CVE-2023-42327

Produtos afetados

Pfsense