CVE-2019-12347
MEDIUMpfSense 2.4.4-p3 - Stored Cross-Site Scripting via ACME Account Name or Description Field
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-12347. PoCs published by Chi Tran.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in pfSense's ACME package. The attacker injects malicious JavaScript payloads into the 'Name' and 'Description' fields, which execute when the page is loaded.
Description
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.
Exploits (1)
This exploit demonstrates a stored XSS vulnerability in pfSense's ACME package. The attacker injects malicious JavaScript payloads into the 'Name' and 'Description' fields, which execute when the page is loaded.
References (5)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N