CVE-2023-39000

MediumCVSS 6.1

Published: 09/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

38th percentile - higher than 38% of all known CVEs

Summary

A reflected XSS vulnerability in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 in the component /ui/diagnostics/log/core/ allows attackers to inject arbitrary JavaScript via the URL path.

Risk Assessment

This vulnerability could lead to user data theft or session hijacking, posing a significant security risk to the organization.

Recommendation

It is recommended to update OPNsense to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.