CVE-2025-34177: Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34177?
The severity of CVE-2025-34177 is classified as medium due to the potential for stored cross-site scripting.
How do I fix CVE-2025-34177?
To fix CVE-2025-34177, ensure to sanitize the policy_name parameter to prevent the injection of HTML-related strings.
What types of attacks can CVE-2025-34177 facilitate?
CVE-2025-34177 can facilitate stored cross-site scripting attacks that may lead to unauthorized actions performed in the context of the authenticated user.
Who is affected by CVE-2025-34177?
Users of Netgate pfSense CE Suricata who have access to the web interface are affected by CVE-2025-34177.
Is there a patch for CVE-2025-34177?
A patch for CVE-2025-34177 should be provided by the pfSense development team, and users should check for updates to apply the fix.