CVE search · CVE-2024-46538

CVE-2024-46538

medium 4.8

A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2024-10-22
Last changed: 2026-06-17
Source: cve@mitre.org
Weakness: CWE-79

Severity

Version	Score	Vector	Source
CVSS 3.1	medium 4.8	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N`	nvd@nist.govPrimary
CVSS 3.1	critical 9.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

netgate · pfsense

References

https://github.com/physicszq/web_issue/blob/main/pfsense/interfaces_groups_edit_file.md_xss.mdExploit
https://redmine.pfsense.org/issues/15778Vendor Advisory

CVE-2024-46538

Details

Severity

Affected products

References