CVE-2022-29273
medium · 6.1pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
6.1
CVSS
59.6%
EPSS (exploit prob.)
99th
EPSS percentile
2023-02-22
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| netgate | pfsense | <= 2.6.0 |
| netgate | pfsense | < 22.05 |
Check a specific version with /api/v1/cve/match.
References
- https://docs.netgate.com/downloads/pfSense-SA-22_05.webgui.asc
- https://docs.netgate.com/pfsense/en/latest/releases/index.html#current-and-upcoming-supported-releases
- https://redmine.pfsense.org/issues/13060
- https://docs.netgate.com/downloads/pfSense-SA-22_05.webgui.asc
- https://docs.netgate.com/pfsense/en/latest/releases/index.html#current-and-upcoming-supported-releases
- https://redmine.pfsense.org/issues/13060
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-29273