PT-2021-10812 · Opnsense · Opnsense

Naivekun · Published 2021-05-03 · Updated 2021-05-11 · CVE-2020-23015

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense versions through 20.1.5

Description An open redirect issue was discovered. The redirect parameter url in the login page was not filtered and can redirect a user to any website.

Recommendations For OPNsense versions through 20.1.5, update to a version later than 20.1.5 to resolve the issue. As a temporary workaround, consider restricting access to the login page or filtering the url parameter to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-23015

Affected Products

Opnsense

References · 4

• 🔥 https://github.com/opnsense/core/issues/4061 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23015 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23015 · Vendor Advisory
• https://t.me/cvenotify/13975 · Telegram Post