CVE-2023-42325
MediumCross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.
Published Dec 15, 2023 · Updated Nov 26, 2024 · Also known as TR-23-0707
Key Facts
Patch immediately- CVE-2023-42325 is a medium-severity vulnerability (CVSS 5.4 v3.1) affecting Pfsense (Netgate).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 58% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
58%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-42325 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| PfsenseNetgate | 2.7.0 | n/a |
Timeline
Publicly disclosed
Dec 15, 2023
Last updated
Nov 26, 2024
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-42325
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-42326
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-42327
- advisoryhttps://www.sonarsource.com/blog/pfsense-vulnerabilities-sonarcloud/
- advisoryUSOM advisory
FAQ
Common Questions.
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.
Affected: Pfsense (Netgate) versions 2.7.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-42325 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo