PT-2015-5701 · Netgate · Pfsense

Publicado 2015-04-10 · Atualizado 2019-05-30 · CVE-2015-2295

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.2.1

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack administrator authentication for requests that delete arbitrary files via the deletefile parameter in the system firmware restorefullbackup.php file within the WebGUI.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the system firmware restorefullbackup.php file to minimize the risk of exploitation. Avoid using the deletefile parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-2295

Produtos afetados

Pfsense

Referências · 7

• 🔥 https://exploit-db.com/exploits/36506 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23251 · Exploit
• 🔥 http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html · Exploit
• http://securityfocus.com/bid/73344 · Nota
• https://pfsense.org/security/advisories/pfSense-SA-15_04.webgui.asc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2295 · Nota de Segurança
• http://securityfocus.com/archive/1/534987/100/0/threaded · Nota