Vulnerability Description
pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netgate | Pfsense | <= 2.6.0 |
Related Weaknesses (CWE)
References
- https://docs.netgate.com/downloads/pfSense-SA-22_05.webgui.asc
- https://docs.netgate.com/pfsense/en/latest/releases/index.html#current-and-upcomRelease Notes
- https://redmine.pfsense.org/issues/13060Patch
- https://docs.netgate.com/downloads/pfSense-SA-22_05.webgui.asc
- https://docs.netgate.com/pfsense/en/latest/releases/index.html#current-and-upcomRelease Notes
- https://redmine.pfsense.org/issues/13060Patch
FAQ
What is CVE-2022-29273?
CVE-2022-29273 is a vulnerability with a CVSS score of 6.1 (MEDIUM). pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
How severe is CVE-2022-29273?
CVE-2022-29273 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-29273?
Check the references section above for vendor advisories and patch information. Affected products include: Netgate Pfsense.