Critical · 9.6 CVE-2020-21487 EUVD-2020-14258GHSA-rff5-9cw2-46c6

Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via t…

Published Apr 4, 2023 · Updated Feb 13, 2025 · Assigned by mitre

Description

Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.

Advisories 1

WID-SEC-2023-0846 Netgate pfSense: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Apr 4, 2023

References

https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8
https://redmine.pfsense.org/issues/9888