CVE-2022-42247

    Dashboard / Vulnerabilities / CVE-2022-42247

    CVE-2022-42247

    Published: 3 Oct 2022Last Modified: 12 Aug 2026

    Summary:

    Details: pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.

    References: https://gist.github.com/enferas/b4ca7a4fb52e1b5e698f87e4d655a70a, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42247.json, https://nvd.nist.gov/vuln/detail/CVE-2022-42247, https://github.com/pfsense/pfsense/commit/73ca6743954ac9f35ca293e3f2af63eac20cf32e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 81891ef87be63352e1c32d28ca9fc08bbf641989
    Fixed -73ca6743954ac9f35ca293e3f2af63eac20cf32e

    Affected versions

    2.5.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-42247 | CVE-DB