CyberRota Analysis
AI-GeneratedAuthenticated users with the Firewall: Schedules: Edit privilege in pfSense Plus versions prior to 26.07 and CE versions before 2.9.0 can inject arbitrary JavaScript through the descr parameter in the firewall schedule editing interface. This vulnerability allows the injected script to execute in the browsers of users with the Firewall: Rules privilege who view the affected rules list, potentially leading to unauthorized actions or data exposure. Organizations using these pfSense versions should prioritize patching to mitigate the risk of cross-site scripting (XSS) attacks.
Original NVD Description
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.