CVE-2020-19201

Name of the Vulnerable Software and Affected Versions: Netgate pfSense versions 2.4.4-p2 and earlier

Description: A Stored Cross-Site Scripting (XSS) issue was found in the status filter reload.php page of the pfSense software WebGUI. The page did not properly encode output from the filter reload process, allowing a stored XSS attack via the descr parameter on NAT rules.

Recommendations: For Netgate pfSense versions 2.4.4-p2 and earlier, update to a version that includes the fix for this issue to prevent stored XSS attacks. As a temporary workaround, consider restricting access to the status filter reload.php page and avoiding the use of the descr parameter on NAT rules until a patch is available.