CVE-2020-11457
CVE-2020-11457
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 9.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
01 Apr 2020Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/157104/pfSense-2.4.4-P3-User-Manager-Cross-Site-Scripting.htmlunverifiedcve_referencewww.exploit-db.com/exploits/48300unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://packetstormsecurity.com/files/157104/pfSense-2.4.4-P3-User-Manager-Cross-Site-Scripting.htmlhttps://github.com/pfsense/pfsense/commit/3c1e53dabe966f27c9097a5a923e77f49ae5fffahttps://www.exploit-db.com/exploits/48300https://www.netgate.com/assets/downloads/advisories/pfSense-SA-20_06.webgui.asc