CVE search · CVE-2020-21487

CVE-2020-21487

critical 9.6

Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.

Open in the NVD CVE.org JSON

Status: Modified
Published: 2023-04-04
Last changed: 2026-06-17
Source: cve@mitre.org
Weakness: CWE-79

Severity

Version	Score	Vector	Source
CVSS 3.1	critical 9.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`	nvd@nist.govPrimary
CVSS 3.1	critical 9.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

netgate · pfsense
netgate · pfsense_acme_package

References

https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8Patch
https://redmine.pfsense.org/issues/9888Issue TrackingPatch
https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8Patch
https://redmine.pfsense.org/issues/9888Issue TrackingPatch

CVE-2020-21487

Details

Severity

Affected products

References