What’s Vulnerable › Vulnerabilities

CVE-2023-44276

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-28 · updated 2026-06-17
• Weakness: CWE-79

Description

OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.

Affected products

• OPNsense: before 23.7.5 — fixed in 23.7.5

How to fix

Upgrade to a fixed version: OPNsense 23.7.5. Check the vendor advisory for mitigations.

References

• https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7
• https://github.com/opnsense/core/compare/23.7.4...23.7.5
• https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense
• https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7
• https://github.com/opnsense/core/compare/23.7.4...23.7.5
• https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense

Get alerted when CVE-2023-44276 or the next vulnerability affects your stack