CVE-2023-39002

MediumCVSS 6.1

Published: 09/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.16%

63th percentile - higher than 63% of all known CVEs

Summary

In OPNsense Community Edition before version 23.7 and Business Edition before version 23.4.2, there is a cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php that allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Risk Assessment

This vulnerability could lead to session hijacking or data theft, posing a significant security risk to the organization.

Recommendation

It is recommended to update OPNsense to the latest version to mitigate this vulnerability and conduct a security audit of the application.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.