CVE-2021-20729

Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.

Score

CVSS 3.1 6.1 Medium

Status

Modified - vultures@jpcert.or.jp

Published

2022-03-31

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Pfsense Plus (Netgate)
• Pfsense (Pfsense)
• Pfsense Ce And Pfsense Plus (Pfsense)

References

• https://docs.netgate.com/downloads/pfSense-SA-21_02.captiveportal.asc
• https://jvn.jp/en/jp/JVN87751554/index.html