CVE-2020-21487

2023-04-0400:00:00

mitre

www.cve.org

netgate pfsense

cross site scripting

arbitrary code execution

acme package

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

58.1%

JSON

Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.

References

github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8

redmine.pfsense.org/issues/9888