cve/2019/CVE-2019-12347.md

CVE-2019-12347

Description

In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.

POC

Reference

• http://packetstormsecurity.com/files/153112/pfSense-2.4.4-p3-Cross-Site-Scripting.html
• http://packetstormsecurity.com/files/153112/pfSense-2.4.4-p3-Cross-Site-Scripting.html
• https://redmine.pfsense.org/issues/9554#change-40729
• https://redmine.pfsense.org/issues/9554#change-40729

Github

No PoCs found on GitHub currently.