CVE-2020-19201

MEDIUM 5.4CVE-2020-19201 · Published 12/07/2021 · updated 17/06/2026

In short

CVE-2020-19201 is a MEDIUM (CVSS 5.4) vulnerability affecting pfsense (netgate).
Chance of exploitation in the next 30 days (EPSS): 3.5%, higher than 89.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pfsense netgate	`= 2.4.4≤ 2.4.4`	No fix yet

Description

A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.

References

docs.netgate.com/pfsense/en/latest/releases/2-4-4-p3.html · Product
gist.github.com/dharmeshbaskaran/fd3779006361d07651a883e8a040d916 · Exploit
pfsense.org/download · Vendor Advisory

More vulnerabilities in pfsense

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pfsense

netgate

= 2.4.4≤ 2.4.4

No fix yet

Description

More vulnerabilities in pfsense

See all →