PT-2019-14865 · Netgate · Pfsense

Lorexxar233 · Publicado 2019-09-26 · Atualizado 2021-07-21 · CVE-2019-16915

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.4.4-p3

Description An issue was discovered where the widgetkey parameter in widgets/widgets/picture.widget.php is used directly without sanitization for a pathname to file get contents or file put contents.

Recommendations For versions prior to 2.4.4-p3, consider updating to a version that includes the necessary sanitization for the widgetkey parameter to prevent potential exploitation. As a temporary workaround, consider restricting access to the picture.widget.php file until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-16915

Produtos afetados

Pfsense

Referências · 5

• https://github.com/pfsense/pfsense/commit/2c544ac61ce98f716d50b8e5961d7dfba66804b5 · Correção
• https://osv.dev/vulnerability/CVE-2019-16915 · Aviso do Fabricante
• https://seebug.org/vuldb/ssvid-98024 · Nota
• https://redmine.pfsense.org/issues/9610 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16915 · Nota de Segurança